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PREFACE 


1.  Scope 

This  publication  describes  the  use  of 
operations  security  (OPSEC)  in  the  planning, 
preparation,  and  execution  of  joint  operations. 
Additionally,  it  provides  the  procedures  for 
the  conduct  of  OPSEC  surveys. 

2.  Purpose 

This  publication  has  been  prepared  under 
the  direction  of  the  Chairman  of  the  Joint 
Chiefs  of  Staff.  It  sets  forth  doctrine  and  to 
govern  the  joint  activities  and  performance 
of  the  Armed  Forces  of  the  United  States  in 
joint  operations  and  provides  the  doctrinal 
basis  for  US  military  involvement  in 
multinational  and  interagency  operations.  It 
provides  military  guidance  for  the  exercise 
of  authority  by  combatant  commanders  and 
other  joint  force  commanders  and  prescribes 
doctrine  for  joint  operations  and  training.  It 
provides  military  guidance  for  use  by  the 
Armed  Forces  in  preparing  their  appropriate 
plans.  It  is  not  the  intent  of  this  publication  to 
restrict  the  authority  of  the  joint  force 
commander  (JFC)  from  organizing  the  force 
and  executing  the  mission  in  a  manner  the  JFC 
deems  most  appropriate  to  ensure  unity  of 
effort  in  the  accomplishment  of  the  overall 
mission. 


3.  Application 

a.  Doctrine  and  guidance  established  in 
this  publication  apply  to  the  commanders 
of  combatant  commands,  subunified 
commands,  joint  task  forces,  and  subordinate 
components  of  these  commands.  These 
principles  and  guidance  also  may  apply  when 
significant  forces  of  one  Service  are  attached 
to  forces  of  another  Service  or  when 
significant  forces  of  one  Service  support 
forces  of  another  Service. 

b.  The  guidance  in  this  publication  is 
authoritative;  as  such,  this  doctrine  (or  JTTP) 
will  be  followed  except  when,  in  the  judgment 
of  the  commander,  exceptional  circumstances 
dictate  otherwise.  If  conflicts  arise  between 
the  contents  of  this  publication  and  the 
contents  of  Service  publications,  this 
publication  will  take  precedence  for  the 
activities  of  joint  forces  unless  the  Chairman 
of  the  Joint  Chiefs  of  Staff,  normally  in 
coordination  with  the  other  members  of  the 
Joint  Chiefs  of  Staff,  has  provided  more 
current  and  specific  guidance.  Commanders 
of  forces  operating  as  part  of  a  multinational 
(alliance  or  coalition)  military  command 
should  follow  multinational  doctrine  and 
procedures  ratified  by  the  United  States.  For 
doctrine  and  procedures  not  ratified  by  the 
United  States,  commanders  should  evaluate 
and  follow  the  multinational  command’s 
doctrine  and  procedures,  where  applicable. 

For  the  Chairman  of  the  Joint  Chiefs  of  Staff: 


DENNIS  C.  BLAIR 
Vice  Admiral,  U S  Navy 
Director,  Joint  Staff 
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EXECUTIVE  SUMMARY 

COMMANDER’S  OVERVIEW 

•  Discusses  the  Characteristics  of  Operations  Security 

•  Covers  Operations  Security  Planning 

•  Details  the  Operations  Security  Process 


General 

Operations  security  Operations  Security  (OPSEC)  is  a  process  of  identifying  critical 

(OPSEC)  is  concerned  information  and  subsequently  analyzing  friendly  actions 

with  identifying,  attendant  to  military  operations  and  other  activities  to:  (a) 

controlling,  and  protecting  identify  those  actions  that  can  be  observed  by  adversary 
the  generally  unclassified  intelligence  systems;  (b)  determine  what  indicators  adversary 
evidence  that  is  associated  intelligence  systems  might  obtain  that  could  be  interpreted  or 
with  sensitive  operations  pieced  together  to  derive  critical  information  in  time  to  be 
and  activities.  useful  to  adversaries;  and  (c)  select  and  execute  measures  that 

eliminate  or  reduce  to  an  acceptable  level  the  vulnerabilities 
of  friendly  actions  to  adversary  exploitation.  OPSEC ’s  most 
important  characteristic  is  that  it  is  a  process  and  not  a 
collection  of  specific  rules  and  instructions  that  can  be 
applied  to  every  operation.  Therefore,  OPSEC  and  security 
programs  must  be  closely  coordinated  to  ensure  that  all  aspects 
of  sensitive  operations  are  protected.  Commanders  must  be 
prepared  to  assume  some  degree  of  risk  because,  in  most  cases, 
OPSEC  entails  the  expenditure  of  resources.  An  OPSEC 
survey  is  essential  for  identifying  requirements  for 
additional  measures  and  for  making  necessary  changes  in 
existing  measures.  Command  and  control  warfare  (C2W)  is 
the  integrated  use  of  psychological  operations,  military 
deception,  OPSEC,  electronic  warfare,  and  physical 
destruction,  mutually  supported  by  intelligence,  to  deny 
information  to,  influence,  degrade,  or  destroy  adversary 
command  and  control  (C2)  capabilities  while  protecting 
friendly  C2  capabilities  against  such  actions.  In  C2W,  the 
threat  to  OPSEC  is  ultimately  the  adversary  commander. 
Denial  of  critical  information  about  friendly  capabilities  and 
limitations  may  result  in  flawed  command  decisions  that  prove 
devastating  to  the  adversary  force.  The  emphasis  of  OPSEC 
as  a  part  of  an  overall  C2W  effort  should  be  to  deny  critical 
information  necessary  for  the  adversary  commander  to 
accurately  estimate  the  militaiy  situation.  The  intent  of  OPSEC 
in  C2  W  should  be  to  force  the  adversary  commander  to  make 
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Executive  Summary 


To  be  effective,  OPSEC 
measures  must  be 
considered  as  early  as 
possible  during  mission 
planning  and  then  be 
appropriately  revised  to 
keep  pace  with  any 
changes  in  current 
operations  and  adversarial 
threats. 


OPSEC  planning  is 
accomplished  through  the 
use  of  the  OPSEC  process. 


faulty  decisions  based  upon  insufficient  information  and/or  to 
delay  the  decision  making  process  due  to  a  lack  of  information. 
Planning  and  executing  OPSEC  measures  require  close 
coordination  with  public  affairs  officers. 

OPSEC  Planning 

Joint  OPSEC  planning  and  execution  occur  as  part  of  the 
command’s  or  organization’s  C2W  effort.  The  commander’s 
objectives  for  C2W  are  the  basis  for  OPSEC  planning.  OPSEC 
is  an  operational  function,  not  a  security  function.  Planning 
must  focus  on  identifying  and  protecting  critical  information, 
and  the  ultimate  goal  of  OPSEC  is  increased  mission 
effectiveness.  OPSEC  should  be  one  of  the  factors 
considered  during  the  development  and  selection  of  friendly 
courses  of  action.  The  termination  of  OPSEC  measures  must 
be  addressed  in  the  OPSEC  plan  in  order  to  prevent  future 
adversaries  from  developing  countermeasures  to  successful 
OPSEC  measures.  There  are  three  major  planning  processes 
for  joint  planning.  Plans  are  proposed  under  different  processes 
depending  on  the  focus  of  a  specific  plan.  The  processes  are 
labeled  either  campaign,  deliberate,  or  crisis  action  planning; 
however,  they  are  interrelated.  OPSEC  plans  are  prepared  as 
part  of  all  joint  operation  plans  and  orders. 

OPSEC  Process 

The  OPSEC  process,  when  used  in  conjunction  with  the  joint 
planning  processes,  provides  the  information  required  to  write 
the  OPSEC  section  of  any  plan  or  order.  The  OPSEC  process 
consists  of  five  distinct  actions:  identification  of  critical 
information,  analysis  of  threats,  analysis  of  vulnerabilities, 
assessment  of  risk,  and  application  of  appropriate  OPSEC 
measures.  These  actions  are  applied  in  a  sequential  manner 
during  OPSEC  planning,  yet  in  some  situations  individual 
actions  may  be  revisited  at  any  time  in  order  to  update  all 
planning  processes. 

CONCLUSION 

This  publication  describes  the  use  of  operations  security  in  the 
planning,  preparation,  and  execution  of  joint  operations. 
Additionally,  it  provides  the  procedures  for  the  conduct  of 
OPSEC  surveys. 


VI 


Joint  Pub  3-54 


CHAPTER  I 

GENERAL 


“If  I  am  able  to  determine  the  enemy’s  dispositions  while  at  the  same  time  I 
conceal  my  own,  then  I  can  concentrate  and  he  must  divide.  ” 


Sun  Tzu, 

The  Art  of  War,  400-320  BC 


1.  Policy 

Policy  for  joint  operations  security 
(OPSEC)  is  established  by  the  Chairman  of 
the  Joint  Chiefs  of  Staff  (CJCS)  Instruction 
3213.01,  “Joint  Operations  Security.” 
Reference  should  be  made  to  that  document 
for  information  concerning  responsibilities 
relating  to  joint  OPSEC  and  for  requirements 
for  establishing  joint  OPSEC  programs. 

2.  Definition 

OPSEC  is  a  process  of  identifying  critical 
information  and  subsequently  analyzing 
friendly  actions  attendant  to  military 
operations  and  other  activities  to: 

a.  Identify  those  actions  that  can  be 
observed  by  adversary  intelligence  systems; 

b.  Determine  what  indicators  hostile 
intelligence  systems  might  obtain  that  could 
be  interpreted  or  pieced  together  to  derive 
critical  information  in  time  to  be  useful  to 
adversaries;  and 

c.  Select  and  execute  measures  that 
eliminate  or  reduce  to  an  acceptable  level 
the  vulnerabilities  of  friendly  actions  to 
adversary  exploitation. 

3.  Characteristics  of  OPSEC 

a.  OPSEC ’s  most  important  characteristic 
is  that  it  is  a  process.  OPSEC  is  not  a 
collection  of  specific  rules  and  instructions  that 
can  be  applied  to  every  operation.  It  is  a 

methodology  that  can  be  applied  to  any 


operation  or  activity  for  the  purpose  of 
denying  critical  information  to  an  adversary. 

b.  Unlike  security  programs  that  seek  to 
protect  classified  information,  OPSEC  is 
concerned  with  identifying,  controUing,  and 
protecting  the  generally  unclassified 
evidence  that  is  associated  with  sensitive 
operations  and  activities.  OPSEC  and 
security  programs  must  be  closely 
coordinated  to  ensure  that  all  aspects  of 
sensitive  operations  are  protected. 

c.  OPSEC  acknowledges  that  commanders 
must  be  prepared  to  assume  some  degree 
of  risk  when  ehoosing  whether  or  not  to 
execute  OPSEC  measures.  OPSEC  measures 
will,  in  most  cases,  entail  the  expenditure  of 
resources.  In  choosing  to  execute  particular 
OPSEC  measures,  commanders  must  decide 
that  the  assumed  gain  in  secrecy  outweighs 
the  costs  in  resources.  If  commanders  decide 
not  to  execute  certain  measures  because  the 
costs  outweigh  the  gain,  then  they  are 
assuming  risks.  The  OPSEC  process  requires 
that  deeision  makers  directly  address  how 
much  risk  they  are  willing  to  assume. 

4.  OPSEC  Survey 

An  OPSEC  survey  is  an  intensive  application 
of  the  OPSEC  process  to  an  existing  operation 
or  activity  by  a  multi-disciplined  team  of  experts. 
Surveys  are  essential  for  identifying 
requirements  for  additional  measures  and  for 
making  necessary  changes  in  existing 
measures.  Appendix  E,  “Procedures  for  OPSEC 
Surveys,”  deseribes  the  procedures  for 
eonducting  OPSEC  surveys. 
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5.  Fundamentals  of  Command 
and  Control  Warfare  (C2W) 

a.  C2W  is  the  integrated  use  of 

psychological  operations  (PSYOP),  military 
deception,  OPSEC,  electronic  warfare  (EW), 
and  physical  destruction,  mutually  supported 
by  intelligence,  to  deny  information  to, 
influence,  degrade,  or  destroy  adversary 
command  and  control  (C2)  capabilities  while 
protecting  friendly  C2  capabilities  against 
such  actions.  C2W  is  a  warfighting 
application  of  information  warfare  (IW)  in 
military  operations  and  is  a  subset  of  IW. 
C2W  applies  across  the  range  of  military 
operations  and  all  levels  of  conflict.  C2W  is 
both  offensive  and  defensive. 

•  C2-attack.  Prevent  effective  C2  of 
adversary  forces  by  denying  information 
to,  influencing,  degrading  or  destroying 
the  adversary  C2  system. 

•  C2-protect.  Maintain  effeetive  C2  of 
own  forces  by  turning  to  friendly 
advantage  or  negating  adversary  efforts 
to  deny  information  to,  influence, 
degrade  or  destroy  the  friendly  C2 
system. 

b.  C2W  employs  various  techniques  and 
technologies  to  attack  or  protect  a  specific 
target  set  —  C2.  C2W  is  applicable  to  both 
war  and  military  operations  other  than  war 
(MOOTW).  C2W  is  planned  and  executed 
by  combatant  commanders,  subunified 
commanders,  and  joint  task  force  commanders. 
C2W  efforts  are  foeused  within  a  commander 
of  a  combatant  command’s  area  of 
responsibility  or  a  commander,  joint  task 
force’s  joint  operations  area  and  their  area  of 
interest  (AOI).  C2W  is  an  essential  part  of 
any  joint  military  operation  opposed  or 
threatened  by  an  organized  military  or 
paramilitary  force.  It  is  an  integral  part  of  an 
overall  campaign  plan.  C2W  applies  to  all 
phases  of  an  operation,  including  those  before, 
during  and  after  actual  hostilities. 


c.  The  elements  of  C2W  (PSYOP, 
military  deception,  OPSEC,  EW,  physical 
destruction)  can  support  land,  sea,  air,  and 
space  operations.  Although  C2W  as  defined 
is  composed  of  these  five  elements,  in  practice 
other  warfighting  capabilities  may  be 
employed  as  part  of  C2W  to  attack  or  protect 
a  C2  “target  set.”  The  level  of  applicability 
of  the  various  C2W  elements  is  dependent  on 
the  assigned  mission  and  the  circumstances, 
targets,  and  resources  available.  C2W 
provides  a  framework  that  promotes 
synergy  between  the  individual  elements 
to  produce  a  significant  warfighting 
advantage.  Even  in  MOOTW,  C2W  offers 
the  military  commander  lethal  and  nonlethal 
means  to  achieve  the  assigned  mission  while 
deterring  war  and/or  promoting  peace. 

d.  Effective  C2W  provides  to  the  joint 
force  commander  (JFC)  an  ability  to  shape 
the  adversary  commander’s  estimate  of  the 
situation  in  the  theater  of  operations.  It  may 
even  be  possible  to  convince  an  adversary  that 
the  United  States  has  “won”  prior  to  engaging 
in  battle,  resulting  in  deterrence  and 
preempting  hostilities. 

e.  A  successful  C2W  effort  will  contribute 
to  the  security  of  friendly  forces,  bring  the 
adversary  to  battle  (if  appropriate)  at  a 
disadvantage,  help  seize  and  maintain  the 
initiative,  enhance  freedom  of  maneuver, 
contribute  to  surprise,  isolate  adversary  forces 
from  their  leadership,  and  create  opportunities 
for  a  systematic  exploitation  of  adversary 
vulnerabilities. 

f.  Effective  C2W  operations  influence, 
disrupt,  or  delay  the  adversary’s  decision 
cycle.  This  decision  cycle  is  supported  by  a 
C2  system  which  does  not  merely  consist  of 
a  commander  and  the  infrastructure  to 
communicate  orders.  It  encompasses  all  the 
capabilities,  thought  processes,  and  actions 
that  allow  a  commander  to  correctly  observe 
the  AOI;  assess  what  those  observations  imply 
about  the  operation;  use  assessments  to  make 
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timely,  effective  decisions;  and  communicate 
those  decisions  as  orders  to  subordinate 
commanders  to  control  the  course  of  an 
operation.  The  execution  of  orders  on  both 
sides  of  an  operation  alters  the  situation  in 
the  operational  area.  These  changes,  in  turn, 
must  be  observed,  assessed,  and  acted  upon 
in  a  continuous  process.  This  process  can 
be  thought  of  as  a  “decision  cycle.” 

g.  Synchronized  C2W  operations  should 
enable  a  JFC  to  operate  “inside”  an 
adversary’s  decision  cycle  by  allowing  the 
JFC  to  process  information  through  the  C2 
decision  cycle  faster  than  an  adversary 
commander.  Initiative  is  fundamental  to 
success  in  military  operations.  In  C2W,  both 
C2-attack  and  C2-protect  operations 


a.  OPSEC  is  concerned  with  denying 
critical  information  about  friendly  forces 
to  the  adversary.  In  C2W,  the  threat  to 
OPSEC  is  ultimately  the  adversary 
commander.  Denial  of  critical  information 
about  friendly  capabilities  and  limitations  may 
result  in  flawed  command  decisions  that  prove 
devastating  to  the  adversary  force.  The  emphasis 
of  OPSEC  as  a  part  of  an  overall  C2W  efibrt 
should  be  to  deny  critical  information 
necessary  for  the  adversary  commander  to 
accurately  estimate  the  militaiy  situation.  The 
intent  of  OPSEC  in  C2W  should  be  to  force  the 
adversary  commander  to  make  faulty  decisions 
based  upon  insufficient  information  and/or  to 
delay  the  decision  making  process  due  to  a  lack 
of  information. 


Since  the  news  media  potentially  can  be  a  lucrative  source  of  information  to 
adversaries,  OPSEC  planners  must  work  closely  with  public  affairs  personnel  to 
avoid  inadvertent  disclosure  of  critical  information. 


contribute  to  gaining  and  maintaining  military 
initiative. 

h.  For  more  information  on  C2W,  see  Joint 
Pub  3-13.1,  “Joint  Doctrine  for  Command  and 
Control  Warfare.” 

6.  OPSEC  and  Command  and 
Control  Warfare 

See  Figure  I-l. 


b.  The  inevitable  presence  of  the  news 
media  during  military  operations 
complicates  OPSEC.  As  part  of  the  global 
information  infrastructure,  the  news  media 
portrays  and  offers  commentary  on  military 
activities  on  the  battlefield — ^both  preparatory 
to  and  during  battle.  News  media  portrayal 
of  military  activities  prior  to  hostilities  can 
help  to  deter  actual  hostilities  and/or  build 
public  support  for  inevitable  hostilities.  By 
portraying  the  presence  of  US  and/or 
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Operations  Security 


A  methodology  that  can  be 
applied  to  any  operation  or 
activity  for  the  purpose  of 
denying  critical  information  to 
an  adversary 


Concerned  with  identifying, 
controlling,  and  protecting  the 
generally  unclassified  evidence 
that  is  associated  with 
sensitive  operations  and 
activities 


tons  Security  In  Command 
and  Control  Warfare 


Deny  critical  information 
necessary  for  the  adversary 
commander  to  accurately 
estimate  the  military  situation 


Force  the  adversary 
commander  to  make  faulty 
decisions  based  upon 
insufRcient  information  and/or 
to  delay  the  decision  making 
process  due  to  lack  of 
information 


Figure  1-1.  Operations  Security  and  Command  and  Control  Warfare 


multinational  military  forces  in  or  en  route 
to  the  operational  area,  news  media  stories 
can  demonstrate  the  readiness, 
commitment  and  resolve  of  the  United 
States  and  its  multinational  partners  to 
commit  military  forces  to  battle  if  necessary 
to  protect  US  and/or  multinational  interests, 
lives,  or  property.  However,  the  presence  of 
the  news  media  in  the  operational  area,  with 
the  capability  to  transmit  information  on  a 
real-time  basis  to  a  worldwide  audience,  has 
the  potential  to  be  a  lucrative  source  of 
information  to  adversaries.  OPSEC 
planners  must  keep  these  considerations  in 
mind  when  determining  which  aspects  of  a 
military  operation  are  “critical  infonnation” 


that  must  be  denied  to  the  adversary.  OPSEC 
planners  must  work  closely  with  military 
public  affairs  personnel  to  develop  guidelines 
that  can  be  used  by  both  military  and  news 
media  personnel  to  avoid  inadvertent 
disclosure  of  critical  information  that  could, 
ultimately,  increase  the  risk  to  the  lives  of 
US  and/or  multinational  military  personnel. 

c.  Denial  of  critical  information  to  the 
adversary  commander  contributes  to 
uncertainty  and  slows  the  adversary’s  decision 
cycle.  Critical  information  can  be  hidden  by 
such  traditional  OPSEC  measures  as  action 
control,  countermeasures,  and 
counteranalysis.  Counterintelligence 


1-4 


Joint  Pub  3-54 


General 


support  is  an  integral  part  of  successful 
OPSEC.  PSYOP  and  military  deception 
personnel  also  work  closely  with  OPSEC 
planners  to  mutually  support  their  respective 
efforts. 

d.  Critical  information  denied  to  an 
adversary  can  be  replaced  or  refocused  to 
support  the  commander’s  goals  through 
military  deception  and/or  PSYOP,  if  use  of 
those  elements  has  been  approved  at  the 


appropriate  level.  In  C2W,  operational 
planners  concerned  with  OPSEC  should 
also  coordinate  with  C2  planners,  EW 
planners,  and  targeteers  to  deny  critical 
information  to  the  adversary  commander.  The 
OPSEC  process  may  also  identify  for  attack 
particular  adversary  collection,  processing, 
analysis,  and  distribution  systems  in  order  to 
deny  the  adversary  commander  critical 
information  by  forestalling  that 
commander’s  ability  to  collect  it. 
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CHAPTER  II 

OPSEC  PLANNING 


“To  keep  your  actions  and  your  plans  secret  always  has  been  a  very  good 
thing . . .  Marcus  Crassus  said  to  one  who  asked  him  when  he  was  going  to 
move  the  army:  ‘Do  you  believe  that  you  will  be  the  only  one  not  to  hear  the 
trumpet?" 


Niccolo  Machiavelli, 
The  Art  of  War.  1521 


1.  General 

a.  In  order  to  prevent  adversaries  (or 
potential  adversaries)  from  gaining  valuable 
intelligence  about  friendly  operations,  joint 
forces  must  plan  and  execute  OPSEC 
measures.  To  be  effective,  OPSEC  measures 
must  be  considered  as  early  as  possible  during 
mission  planning  and  then  be  appropriately 
revised  to  keep  pace  with  any  changes  in 
current  operations  and  adversarial  threats. 

b.  Joint  OPSEC  planning  and  execution 
occur  as  part  of  the  command’s  or 
oi^anization’s  C2W  effort  The  commander’s 
objectives  for  C2W  are  the  basis  for  OPSEC 
planning.  In  addition  to  directly  supporting 
the  accomplishment  of  the  commander’s 


objectives,  the  use  of  OPSEC  measures  in 
support  of  the  other  components  of  C2W  must 
also  be  considered  during  OPSEC  planning. 

2.  OPSEC  Planning  Factors 

The  following  factors  must  be  considered 
when  conducting  OPSEC  planning: 

a.  The  commander  plays  the  critical  role. 

OPSEC  planning  guidance  must  be  provided 
as  part  of  the  commander’s  C2W  planning 
guidance  to  ensure  that  OPSEC  is  considered 
during  the  development  of  friendly  courses 
of  action  (COAs). 

b.  OPSEC  is  an  operational  function, 

not  a  security  function.  OPSEC  planning 


While  planning  joint  operations,  including  those  requiring  highly  visible  deployments, 
OPSEC  measures  must  be  considered  as  early  as  possible  to  prevent  adversaries 
from  gaining  valuable  intelligence. 
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must  be  done  by  the  operations  planners. 
They  are  assisted  by  the  organization’s 
OPSEC  program  personnel  and  appropriate 
planners  from  other  staff  elements. 
Intelligence  support  is  particularly  important 
in  determining  the  threat  to  friendly 
operations  and  in  assessing  friendly 
vulnerabilities. 

c.  Planning  must  focus  on  identifying 
and  protecting  critical  information. 

Denying  all  information  about  a  friendly 
operation  or  activity  is  seldom  cost  effective 
or  realistic. 

d.  The  ultimate  goal  of  OPSEC  is 
increased  mission  effectiveness.  By 

preventing  an  adversary  from  determining 
friendly  intentions  or  eapabilities,  OPSEC 
reduces  losses  to  friendly  units  and  increases 
the  likelihood  of  mission  success. 

e.  OPSEC  should  be  one  of  the  factors 
considered  during  the  development  and 
selection  of  friendly  COAs.  COAs  will  differ 
in  terms  of  how  many  OPSEC  indicators  will 
be  created  and  how  easily  those  indicators  can 
be  managed  by  OPSEC  measures.  Depending 
upon  how  important  maintaining  secrecy  is 
to  mission  success,  OPSEC  considerations 
may  be  a  factor  in  selecting  a  COA. 

“O  divine  art  of  subtlety  and  secrecy! 

Through  you  we  learn  to  be  invisible, 

through  you  inaudible;  and  hence  hold 

the  enemy’s  fate  in  our  hands.  ” 

Sun  Tzu,  c.  500  BC 
The  Art  of  War 

f.  OPSEC  planning  is  a  continuous  process. 

During  the  execution  phase  of  an  operation, 
feedback  on  the  success  or  failure  of  OPSEC 
measures  is  evaluated  and  the  OPSEC  plan 
is  modified  accordingly.  Friendly  intelligence 
and  counterintelligence  organizations, 
eommunications  security  (COMSEC) 
monitoring,  and  OPSEC  surveys  are  the  primary 
sources  for  feedback  infomiation. 


g.  Public  affairs  officers  should 
participate  in  OPSEC  planning  to  provide 
their  assessments  on  the  possible  effects  of 
media  coverage  and  for  the  coordination  of 
OPSEC  measures  to  minimize  those  effects. 

h.  The  termination  of  OPSEC  measures 
must  be  addressed  in  the  OPSEC  plan  to 

prevent  future  adversaries  from  developing 
countermeasures  to  successful  OPSEC 
measures.  In  some  situations,  it  may  be 
necessary  for  the  OPSEC  plan  to  provide 
guidance  on  how  to  prevent  the  target  of  the 
OPSEC  operation  as  well  as  any  interested 
third  parties  from  discovering  sensitive 
information  relating  to  OPSEC  during  the 
post-execution  phase. 

3.  OPSEC  Planning  and  the 
Joint  Operation  Planning 
Processes 

a.  Joint  OPSEC  Planning.  OPSEC 
planning  in  support  of  joint  operations  is 
accomplished  through  the  application  of 
the  OPSEC  process.  The  five  actions  that 
compose  the  OPSEC  process  are  described 
in  detail  in  Chapter  III,  “The  OPSEC 
Process.”  Joint  OPSEC  planning  is  always 
done  in  conjunction  with  normal  joint 
operation  planning  and  is  a  part  of  the  overall 
C2W  planning  effort. 

b.  Planning  Processes.  There  are  three 
major  planning  processes  for  joint  planning. 
Plans  are  proposed  under  different  processes 
depending  on  the  focus  of  a  specific  plan.  The 
proeesses  are  labeled  either  campaign, 
deliberate,  or  crisis  action  planning,  and  are 
interrelated.  They  are  described  in  Joint  Pub 
5-0,  “Doctrine  for  Planning  Joint  Operations.” 

c.  The  Deliberate  Planning  Process. 

OPSEC  planning  relates  to  the  Joint  Operation 
Planning  and  Execution  System  (JOPES) 
deliberate  planning  process  as  shown  in 
Figure  II- 1. 
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d.  The  Crisis  Action  Planning  Process. 

OPSEC  planning  relates  to  the  JOPES  crisis 
action  planning  pfocess  as  shown  in  Figure 
II-2. 

e.  The  Campaign  Planning  Process 

•  Combatant  commanders  translate 
national  and  theater  strategy  into  strategic 
and  operational  concepts  through  the 
development  of  theater  campaign 
plans.  The  campaign  plan  embodies  the 
combatant  commander’s  strategic  vision 
of  the  arrangement  of  related  operations 
necessary  to  attain  theater  strategic 
objectives.  Campaign  planning 
encompasses  both  the  deliberate  and 
crisis  action  planning  processes.  If  the 
scope  of  contemplated  operations 
requires  it,  campaign  planning  begins 
with  or  during  deliberate  planning.  It 
continues  through  crisis  action  planning, 
thus  unifying  both  planning  processes. 
As  stated  in  Joint  Pub  1,  “Joint  Warfare 
of  the  Armed  Forces  of  the  United 
States,”  “Campaign  planning  is  done  in 
crisis  or  conflict  (once  the  actual  threat, 
national  guidance,  and  available 
resources  become  evident),  but  the  basis 
and  framework  for  successful  campaigns 
is  laid  by  peacetime  analysis,  planning, 
and  exercises.”  The  degree  to  which  the 
amount  of  work  accomplished  in 
deliberate  planning  may  serve  as  the  core 
for  a  campaign  plan  is  directly  dependent 
on  the  particular  theater  and  objectives. 

•  Preparation  of  a  campaign  plan  is 
appropriate  when  contemplated 
military  operations  exceed  the  scope 
of  a  single  major  operation.  Campaign 
planning  is  appropriate  to  both  deliberate 
and  crisis  action  planning.  During 
peacetime  deliberate  planning, 
combatant  commanders  prepare  joint 
operation  plans  (OPLANs),  including 
campaign  plans,  in  direct  response  to 
taskings  in  the  Joint  Strategic  Capabilities 


Plan.  Tasking  for  strategic  requirements 
or  major  contingencies  may  require  the 
preparation  of  several  alternative  plans 
for  the  same  requirement  using  different 
sets  of  forces  and  resources  to  preserve 
flexibility.  For  these  reasons,  campaign 
plans  are  based  on  reasonable 
assumptions  and  are  not  normally 
completed  until  after  the  National 
Command  Authorities  (NCA)  selects  the 
course  of  action  during  crisis  action 
planning.  Deliberate  plans  may  include 
elements  of  campaign  planning; 
however,  these  elements  will  have  to  be 
updated  as  in  any  deliberate  plan  used  at 
execution.  Execution  planning  is 
conducted  for  the  actual  commitment 
of  forces  when  conflict  is  imminent.  It 
is  based  on  the  current  situation  and 
includes  deployment  and  initial 
employment  of  forces.  When  a  crisis 
situation  develops,  an  assessment  is 
conducted  that  may  result  in  the  issuance 
ofaCJCS  WARNING  ORDER.  COAs 
are  developed  based  on  an  existing 
OPLAN  or  operation  plan  in  concept 
format  (CONPLAN),  if  applicable.  The 
combatant  commander  proposes  COAs 
and  makes  any  recommendations  when 
the  Commander’s  Estimate  is  forwarded 
to  the  NCA.  The  NCA  selects  a  COA 
and,  when  directed,  the  Chairman 
issues  a  CJCS  ALERT  ORDER.  The 
combatant  commander  now  has  the 
essential  elements  necessary  for 
finalizing  the  construction  of  a  campaign 
plan  using  the  approved  COA  as  the 
centerpiece  of  the  plan.  OPSEC  planning 
is  done  the  same  as  in  crisis  action 
planning  (see  Figure  II-2). 

f  OPSEC  Plans  Format.  OPSEC  plans 
are  prepared  as  part  of  all  joint  operation 
plans  and  orders.  The  format  is  found  in 
Joint  Pub  5-03.2,  “Joint  Operation  Planning 
and  Execution  System,  Vol  II:  (Planning  and 
Execution  Formats  and  Guidance).” 
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Figure  11-1.  Deliberate  Planning  Process 
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Figure  11-2.  Crisis  Action/Campaign  Planning  Process 
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THE  “BLACK  HOLE”:  OPSEC  DURING  PLANNING 

During  the  autumn  of  1990,  joint  force  air  component  commander  (JFACC) 
planners  merged  the  Air  Force  Component,  Central  Command  (CENTAF)  pre¬ 
deployment  concept  of  operations  with  the  INSTANT  THUNDER  concept  to 
form  the  foundation  for  the  Operation  DESERT  STORM  plan  for  air  operations. 

Navy,  USMC,  and  Army  planners  worked  closely  with  Air  Force  (USAF)  planners 
in  August  and  September  to  draft  the  initial  offensive  air  plan.  In  Riyadh,  Navy 
Component,  Central  Command  (NAVCENT),  Marine  Corps  Component,  Central 
Command  (MARCENT),  and  Army  Component,  Central  Command  (ARCENT) 
were  integral  planning  process  members.  Royal  Air  Force  (RAF)  planners 
Joined  the  JFACC  staff  on  19  September. 

CENTCOM’s  offensive  air  special  planning  group  (SP6),  In  the  Royal  Saudi  Air 
Force  (RSAF)  headquarters,  was  part  of  the  JFACC  staff  and  eventually  became 
known  as  the  “Black  Hole”  because  of  the  extreme  secrecy  surrounding  its 
activities.  The  Black  Hole  was  led  by  a  USAF  brigadier  general,  reassigned 
from  the  USS  Lasalle  (AGF  3)  where  he  had  been  serving  as  the  deputy 
commander  of  Joint  Task  Force  Middle  East  when  Iraq  invaded  Kuwait.  His 
small  staff  grew  gradually  to  about  30  and  included  RAF,  Army,  Navy,  USMC, 
and  USAF  personnel.  By  15  September,  the  initial  air  planning  stage  was 
complete;  the  President  was  advised  there  were  sufficient  air  forces  to  execute 
and  sustain  an  offensive  strategic  air  attack  against  Iraq,  should  he  order  one. 
However,  because  of  operational  security  (OPSEC)  concerns,  most  of  CENTAF 
headquarters  was  denied  Information  on  the  plan  until  only  a  few  hours  before 
execution. 


SOURCE:  Final  Report  to  Congress 
Conduct  of  the  Persian  Gulf  War.  April  1992 
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“He  passes  through  life  most  securely  who  has  least  reason  to  reproach 
himself  with  complaisance  toward  his  enemies.” 


Thucydides, 

History  of  the  Peloponnesian  Wars.  404  BC 


1.  General 

a.  OPSEC  planning  is  accomplished 
through  the  use  of  the  OPSEC  process.  This 
process,  when  used  in  conjunction  with  the 
joint  planning  processes,  provides  the 
information  required  to  write  the  OPSEC 
section  of  any  plan  or  order.  OPSEC  planning 
is  done  in  close  coordination  with  the  overall 
C2W  planning  effort  and  with  the  planning 
of  the  other  C2W  components. 

b.  The  OPSEC  process  consists  of  five 
distinct  actions.  These  actions  are  applied 
in  a  sequential  or  adaptive  manner  during 
OPSEC  planning.  In  dynamic  situations, 
however,  individual  actions  may  be  revisited 
at  any  time.  New  information  about  the 
adversary’s  intelligence  collection 
capabilities,  for  instance,  would  require  a  new 
analysis  of  threats. 

c.  An  understanding  of  the  following 
terms  is  required  before  the  process  can  be 
explained. 

•  Critical  Information.  Specific  facts 
about  friendly  intentions,  capabilities, 
and  activities  vitally  needed  by 
adversaries  for  them  to  plan  and  act 
effectively  so  as  to  guarantee  failure  or 
unacceptable  consequences  for  friendly 
mission  accomplishment. 

•  OPSEC  Indicators.  Friendly  detectable 
actions  and  open-source  information  that 
can  be  interpreted  or  pieced  together  by 
an  adversary  to  derive  critical 
information. 


•  OPSEC  Vulnerability.  A  condition  in 
which  friendly  actions  provide  OPSEC 
indicators  that  may  be  obtained  and 
accurately  evaluated  by  an  adversary  in 
time  to  provide  a  basis  for  effective 
adversary  decision  making. 

2.  The  OPSEC  Process 

See  Figure  III-l  and  Figure  III-2. 

a.  OPSEC  Action  1 —  Identification  of 
Critical  Information 

•  While  assessing  and  comparing  friendly 
versus  adversary  capabilities  during  the 
planning  process  for  a  specific  operation 
or  activity,  the  commander  and  staff 
seek  to  identify  the  questions  that  they 
believe  the  adversary  will  ask  about 
friendly  intentions,  capabilities,  and 
activities.  These  questions  are  the 
essential  elements  of  friendly 
information  (EEFI).  In  an  operation 
plan  or  order,  the  EEFI  are  listed  in 
Appendix  3  (Counterintelligence)  to 
Annex  B  (Intelligence). 

•  Critical  information  is  a  subset  of 
EEFI.  It  is  only  that  information  that  is 
vitally  needed  by  an  adversary.  The 
identification  of  critical  information  is 
important  in  that  it  focuses  the 
remainder  of  the  OPSEC  process  on 
protecting  vital  information  rather  than 
attempting  to  protect  all  classified  or 
sensitive  information. 
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THE  SEQUENTIAL 
OPERATIONS  SECURITY 
(OPSEC)  PROCESS 


OPSEC  ACTION  1 


Identification  of  Critical 
Information 


OPSEC  ACTION  2 ^ 

Analysis  of  Threats 

^^P^C  ACTION^^ 

Analysis  of 
Vulnerabilities 

^^PS^ACTION^^ 

Assessment  of  Risk 

^OPSEC  ACTION  5^ 


Application  of 
Appropriate  OPSEC 
Measures 


Figure  III-1.  The  Sequential  Operations 
Security  (OPSEC)  Process 


•  Critical  information  is  listed  in  the 
OPSEC  portion  of  an  operation  plan 
or  order.  Some  general  categories  of 
critical  information  are  provided  in 
Appendix  A,  “Examples  of  Critical 
Information.” 


b.  OPSEC  Action  2  — Analysis  ofThreats 

•  This  action  involves  the  research  and 
analysis  of  intelligence  information, 
counterintelligence,  reports,  and  open 
source  information  to  identify  who  the 
likely  adversaries  are  to  the  planned 
operation. 

•  The  operations  planners,  working  with 
the  intelligence  and  counterintelligence 
staffs  and  assisted  by  the  OPSEC 
program  personnel,  seek  answers  to  the 
following  questions: 

••  Who  is  the  adversary?  (Who  has  the 
intent  and  capability  to  take  action  against 
the  planned  operation?) 

••  What  are  the  adversary’s  goals? 
(What  does  the  adversary  want  to 
accomplish?) 

••  What  is  the  adversary’s  strategy  for 
opposing  the  planned  operation?  (What 
actions  might  the  adversary  take?) 

••  What  critical  information  does  the 
adversary  already  know  about  the 
operation?  (What  infomiation  is  it  too 
late  to  protect?) 

••  What  are  the  adversary’s  intelligence 
collection  capabilities? 

•  Detailed  information  about  the 
adversary’s  intelligence  collection 
capabilities  can  be  obtained  from  the 
command’s  counterintelligence  and 
intelligence  organizations.  In  addition 
to  knowing  about  the  adversary’s 
capabilities,  it  is  important  to 
understand  how  the  intelligence 
system  processes  the  information  that 
it  gathers.  Appendix  B,  “The 
Intelligence  Threat,”  discusses  the 
general  characteristics  of  intelligence 
systems. 
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THE  ADAPTIVE  OPERATIONS  SECURITY  (OPSEC) 

PROCESS 


CRITICAL  INFO 


VULNERABILITY 


THREAT 


ASSESS  RISKS 
AND 

APPLY  COUNTERMEASURES 


Figure  III-2.  The  Adaptive  Operations  Security  (OPSEC)  Process 


c.  OPSEC  Action  3  —  Analysis  of 
Vulnerabilities 

“Little  minds  try  to  defend  everything 
at  once,  but  sensible  people  look  at  the 
main  point  only;  they  parry  the  worst 
blows  and  stand  a  little  hurt  if  thereby 
they  avoid  a  greater  one.  If  you  try  to 
hold  everything,  you  hold  nothing.  ” 

Frederick  the  Great 
The  Art  of  Modern  War.  1940 

•  The  purpose  of  this  action  is  to  identify 
an  operation’s  or  activity’s  OPSEC 
vulnerabilities.  It  requires  examining 
each  aspect  of  the  planned  operation  to 
identify  any  OPSEC  indicators  that  could 
reveal  critical  information  and  then 
corhparing  those  indicators  with  the 
adversary’s  intelligence  collection 
capabilities  identified  in  the  previous 
action.  A  vulnerability  exists  when  the 
adversary  is  capable  of  collecting  an 
OPSEC  indicator,  correctly  analyzing  it, 
and  then  taking  timely  action. 


•  Continuing  to  work  with  the  intelligence 
and  counterintelligence  staffs,  the 

operations  planners  seek  answers  to 
the  following  questions: 

••  What  indicators  (friendly  actions  and 
open  source  information)  of  critical 
information  not  known  to  the  adversary 
will  be  created  by  the  friendly  activities 
that  will  result  from  the  planned 
operation? 

••  What  indicators  can  the  adversary 
actually  collect? 

••  What  indicators  will  the  adversary  be 
able  to  use  to  the  disadvantage  of  friendly 
forces?  (Can  the  adversary  analyze  the 
information,  make  a  decision,  and  take 
appropriate  action  in  time  to  interfere 
with  the  planned  operation?) 

•  See  Appendix  C,  “OPSEC  Indicators,” 
for  a  detailed  discussion  of  OPSEC 
indicators. 


III-3 


Chapter  III 


When  conducting  joint  operations,  all  personnel  must  understand  the  adversary's 
intelligence  collection  capabilities  and  take  action  to  deny  the  use  of  those 
capabilities. 


d.  OPSEC  Action  4 — Assessment  of  Risk 

•  This  action  has  two  components.  First, 
planners  analyze  the  OPSEC 
vulnerabilities  identified  in  the  previous 
action  and  identify  possible  OPSEC 
measures  for  each  vulnerability.  Second, 
specific  OPSEC  measures  are  selected 
for  execution  based  upon  a  risk 
assessment  done  by  the  commander  and 
staff. 


••  More  than  one  possible  measure 
may  be  identified  for  each 
vulnerability.  Conversely,  a  single 
measure  may  be  used  for  more  than  one 
vulnerability.  The  most  desirable 
OPSEC  measures  are  those  that  combine 
the  highest  possible  protection  with  the 
least  effect  on  operational  effectiveness. 
Appendix  D,  “Operations  Security 
Measures,”  provides  examples  of 
OPSEC  measures. 


•  OPSEC  measures  reduce  the  probability 
of  the  adversary  either  collecting  the 
indicators  or  being  able  to  correctly 
analyze  their  meaning. 

••  OPSEC  measures  can  be  used  to: 

( 1 )  Prevent  the  adversary  from  detecting 
an  indicator;  (2)  Provide  an  alternative 
analysis  of  an  indicator;  and/or  (3) 
Attack  the  adversary’s  collection  system. 

••  OPSEC  measures  include,  among 
other  actions,  cover,  coneealment, 
camouflage,  deception,  intentional 
deviations  from  normal  patterns,  and 
direct  strikes  against  the  adversary’s 
intelligence  system. 


•  Risk  assessment  requires  comparing  the 
estimated  cost  associated  with 
implementing  each  possible  OPSEC 
measure  to  the  potential  harmful  effects 
on  mission  accomplishment  resulting 
from  an  adversary’s  exploitation  of  a 
particular  vulnerability. 

••  OPSEC  measures  usually  entail 
some  cost  in  time,  resources,  personnel, 
or  interference  with  normal  operations. 
If  the  cost  to  mission  effectiveness 
exceeds  the  harm  that  an  adversary  could 
inflict,  then  the  application  of  the  measure 
is  inappropriate.  Because  the  decision 
not  to  implement  a  particular  OPSEC 
measure  entails  risks,  this  step  requires 
command  involvement. 
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••  Typical  questions  that  might  be 
asked  when  making  this  analysis 
include  the  following:  (1)  What  risk  to 
effectiveness  is  likely  to  occur  if  a 
particular  OPSEC  measure  is 
implemented?  (2)  What  risk  to  mission 
success  is  likely  to  occur  if  an  OPSEC 
measure  is  not  implemented?  (3)  What 
risk  to  mission  success  is  likely  if  an 
OPSEC  measure  fails  to  be  effective? 

••  The  interaction  of  OPSEC 
measures  must  be  analyzed.  In  some 
situations,  certain  OPSEC  measures  may 
actually  create  indicators  of  critical 
information.  For  example,  the 
camouflaging  of  previously  unprotected 
facilities  could  be  an  indicator  of 
preparations  for  military  action. 

The  selection  of  measures  must  be 
coordinated  with  the  other 
components  of  C2W.  Actions  such  as 
jamming  of  intelligence  nets  or  the 
physical  destruction  of  critical 
intelligence  centers  can  be  used  as 
OPSEC  measures.  Conversely,  military 
deception  and  PSY OP  plans  may  require 
that  OPSEC  measures  not  be  applied  to 


certain  indicators  in  order  to  project  a 
specific  message  to  the  adversary. 

e.  OPSEC  Action  5  —  Application  of 
Appropriate  OPSEC  Measures 

•  In  this  step,  the  command  implements 
the  OPSEC  measures  selected  in  Step 
4  or,  in  the  case  of  planned  future 
operations  and  activities,  includes  the 
measures  in  specific  OPSEC  plans. 

•  During  the  execution  of  OPSEC 
measures,  the  reaction  of  adversaries 
to  the  measures  is  monitored  to 
determine  their  effectiveness  and  to 
provide  feedback.  Planners  use  that 
feedback  to  adjust  ongoing  activities  and 
for  future  OPSEC  planning.  Provisions 
for  feedback  must  be  coordinated  with 
the  command’s  intelligence  and 
counterintelligence  staffs  to  ensure  that 
the  requirements  to  support  OPSEC 
receive  the  appropriate  priority.  In 
addition  to  intelligence  sources  providing 
feedback,  OPSEC  surveys  can  provide 
useful  information  relating  to  the  success 
of  OPSEC  measures. 


A  key  action  during  the  OPSEC  process  is  to  analyze  potential  vulnerabilities  to 

joint  forces. 
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EXAMPLES  OF  CRITICAL  INFORMATION 


This  appendix  provides  general  examples 
of  critical  information.  Several  generic 
military  activities  with  some  of  their 
associated  critical  information  are  listed. 
These  are  only  a  few  of  the  many  types  of 
military  activities  and  their  associated  critical 
information. 

a.  Diplomatic  Negotiations 

•  Military  capabilities  (pretreaty  and 
posttreaty) 

•  Intelligence  verification  capabilities 

•  Minimum  negotiating  positions 

b.  Politico-Military  Crisis  Management 

•  Target  selection 

•  Timing  considerations 

•  Logistic  capabilities  and  limitations 

•  Alert  posture 

c.  Military  Intervention 

•  Intentions 

•  Military  capabilities 

•  Forces  assigned  and  in  reserve 

•  Targets 

•  Timing 

•  Logistic  capabilities  and  constraints 

•  Limitations 

•  Third-nation  support  arrangements 


d.  Counterterrorism 

•  Forces 

•  Targets 

•  Timing 

•  Staging  locations 

•  Tactics 

•  Ingress  and  egress  methods 

•  Logistic  capabilities  and  constraints 

e.  Open  Hostilities 

•  Force  composition  and  disposition 

•  Attrition  and  reinforcement 

•  Targets 

•  Timing 

•  Logistic  constraints 

•  Location  of  critical  C2  nodes 

f.  Mobilization 

•  Intent  to  mobilize  before  public 
announcement 

•  Impact  on  military  industrial  base 

•  Impact  on  civil  economy 

•  Transportation  capabilities  and 
limitations 

g.  Intelligence,  Reconnaissance,  and 
Surveillance 
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•  Purpose  of  collection 

•  Targets  of  collection 

•  Timing 

•  Capabilities  of  collection  assets 

•  Processing  capabilities 

•  Unit  requesting  collection 

h.  Peacetime  Weapons  and  Other 
Military  Movements 

•  Fact  of  movement 

•  Periodicity  of  movements 

•  Origin  and  destination  of  equipment 
being  moved 

•  Capabilities  and  limitations  of  equipment 
being  moved 

•  Extent  of  inventory  of  equipment  being 
moved 

i.  Command  Post  or  Field  Training 
Exercises 

•  Participating  units 

•  OPLAN,  CONPLANs,  or  other 
contingencies  that  are  being  exercised 

•  Command  relationships 

•  Command,  control,  communications,  and 
computers  connections  and  weaknesses 


•  Logistic  capabilities  and  limitations 

j.  Noncombatant  Evacuation  Operations 
(Hostile  Environment) 

•  Targets 

•  Forces 

•  Logistic  constraints 

•  Safe  havens 

•  Routes 

•  Timing 

k.  Counterdrug  Operations 

•  Identity  of  military  forces 

•  Law  Enforcement  Agency  (LEA) 
involvement 

•  Military  support  to  LEAs 

•  Host-nation  cooperation 

•  Capabilities 

•  Timing 

•  Tactics 

•  Logistic  capabilities  and  constraints 
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THE  INTELLIGENCE  THREAT 


1.  Introduction 


2.  The  Intelligence  Cycle 


Adversaries  and  potential  adversaries 
collect  and  analyze  information  about  US 
military  operations  in  order  to  determine 
current  capabilities  and  future  intentions.  To 
perform  this  function,  most  adversaries  have 
created  intelligence  organizations  and 
systems.  The  capabilities  and  levels  of 
sophistication  of  these  threats  differ  greatly, 
but  they  all  share  certain  core  characteristics. 
The  most  important  of  these  are  how 
intelligence  is  developed  and  how  it  is 
collected.  This  appendix  will  describe  those 
characteristics. 


All  intelligence  systems  follow  a  process. 
This  process  begins  with  a  consumer  (a 
commander  or  decision  maker)  requesting 
answers  to  certain  questions  and  ends  with 
the  intelligence  system  providing  those 
answers.  Figure  B-1  illustrates  a  typical 
intelligence  cycle  (in  this  case,  the  intelligence 
cycle  described  in  Joint  Pub  2-0,  “Joint 
Doctrine  for  Intelligence  Support  to 
Operations”).  Understanding  the  concept  of 
the  intelligence  cycle  is  basic  to  understanding 
the  total  adversary  intelligence  threat  to 
friendly  operations  in  general  and  the  specific 
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threat  to  the  critical  information  that  OPSEC 
seeks  to  protect. 

a.  Planning  and  Direction 

•  Decision  makers  task  their  intelligence 
systems  to  collect  and  assess  information 
about  their  adversaries  and  potential 
adversaries.  These  information 
requirements  are  the  basis  for  intelligence 
collection,  evaluation,  and  reporting. 

•  These  information  requirements  will 
normally  include  any  infonnation  that 
would  allow  the  decision  maker  to  better 
understand  an  adversary’s  goals, 
intentions,  eurrent  capabilities,  strengths, 
and  weaknesses.  At  the  operational  and 
strategic  levels  of  war,  deeision  makers 
will  want  to  know  what  their  adversary 
counterparts  think;  how  they  make  their 
decisions;  and  their  social,  cultural, 
economic,  and  political  beliefs  and  habits. 

•  Intelligence  specialists  take  the  decision 
maker’s  infonnation  requirements  and  turn 
them  into  speeific  intelligence  taskings. 

b.  Collection 

•  After  determining  the  taskings,  the 
intelligence  system  will  evaluate  the 
currency  and  amount  of  information 
already  at  hand.  If  more  or  newer 
information  is  needed,  collection 
requirements  will  be  submitted  to  the 
appropriate  collection  resources. 

•  Information  may  be  collected  either 
overtly  or  clandestinely. 

••  Overt  colleetion  may  include  such 
activities  by  military  attaches  assigned 
to  embassies  and  the  review  of  available 
open-source  information. 


••  Clandestine  collection  acquires 
information  while  concealing  the 
collection  effort  and  consists  of  espionage 
and  technical  means  such  as  signals  and 
imagery  intelligence. 

c.  Processing.  Collected  infonnation  must 
be  processed  into  a  fonn  that  is  suitable  for 
the  production  of  intelligence.  For  example, 
imagery  film  must  be  developed  and  signals 
must  be  processed  before  they  can  be 
evaluated,  analyzed,  and  interpreted  for 
significance. 

d.  Production 

•  The  still  raw  intelligence  is  evaluated  for 
accuracy,  reliability,  and  credibility.  It  is 
compared  for  consistency  with  known 
data  and  examined  for  meaningful 
associations  by  analyzing  it  against  its 
historical  background.  It  is  combined 
with  other  information.  The  information 
is  analyzed,  interpreted,  and  prepared  for 
presentation  to  the  eonsumer.  There  are 
numerous  types  of  intelligence  products 
ranging  from  informal  briefings  to 
multivolume  written  studies. 

•  Generally,  every  product  attempts  to 
address  the  questions,  “What  is  the 
adversary  doing  now?"  and  "What  is  it 
going  to  do  next?”  In  many  cases, 
because  of  inadequate  collection  or 
insufficient  time  for  processing  and 
analysis,  intelligence  analysts  will  not  be 
able  to  provide  unambiguous  answers  to 
those  questions.  This  phase  of  the 
intelligence  cycle  is  still  more  art  than 
seience. 

e.  Dissemination.  In  this  step,  the  product 
is  delivered  to  the  consumer.  There  are  as 
many  forms  of  delivery  as  there  are  products 
and  consumers.  Automated  means  are 
becoming  increasingly  important  in  many 
intelligence  systems. 
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3.  Intelligence  Sources 

a.  Human  Intelligence  (HUMINT). 

HUMINT  uses  people  to  gain  information  that 
is  often  inaccessible  by  other  collection 
means.  Although  it  is  the  oldest  and  most 
basic  form  of  intelligence  collection, 
HUMINT  remains  significant  because  it  is 
often  the  only  source  with  direct  access  to  the 
opponent’s  plans  and  intentions.  Clandestine 
HUMINT  collection  is  done  in  a  fashion  that 
maintains  the  secrecy  of  the  collection 
operation. 

b.  Imagery  Intelligence  (IMINT) 

•  IMINT  is  derived  from  visual 
photography,  infrared  sensors,  lasers, 
electro-optics,  and  radar  sensors.  IMINT 
systems  can  operate  from  land,  sea,  air, 
and/or  space  platforms.  Imagery 
equipment  is  being  improved  constantly, 
and  combinations  of  sensors  are  being 
used  to  enhance  the  quality  and  timeliness 
of  the  intelligence  product. 

•  An  increasing  number  of  countries  are 
starting  to  use  photo  reconnaissance 
satellites.  In  addition  to  being  a  major 
strategic  collection  capability,  they  are 
becoming  an  increasingly  important 
operational  and  tactical  capability.  The 
traditional  airborne  IMINT  platforms 
remain  an  important  capability  for  those 
countries  without  access  to  satellite 
imagery. 

c.  Signals  Intelligence  (SIGINT). 

SIGINT  is  derived  from  communication 
(COMINT),  electronics  (FLINT),  and  foreign 
instrumentation  signals  (FISINT). 


communications  and  unencrypted 
computer-to-computer  data  communications. 

•  FLINT  is  technical  or  geolocation 
intelligence  derived  from  foreign  non¬ 
communications  electromagnetic 
radiations  emanating  from  other  than 
nuclear  detonations  or  radioactive 
sources.  Radars  are  the  primary  FLINT 
source. 

•  FISINT  is  derived  from  the  intercept  and 
analysis  of  electronically  transmitted  data 
containing  measured  parameters  of 
performance,  such  as  a  ballistic  missile’s 
performance  during  a  test  flight. 

d.  Measurement  and  Signature 
Intelligence  (MASINT).  MASINT  is 
scientific  and  technical  intelligence  obtained 
by  the  quantitative  and  qualitative  analysis  of 
data  (metric,  angle,  spatial,  wavelength,  time 
dependence,  modulation,  plasma,  and 
hydromagnetic)  derived  from  specific 
technical  sensors  for  the  purpose  of  identifying 
any  distinctive  features  associated  with  the 
source,  emitter,  or  sender  and  to  facilitate 
subsequent  identification  and/or  measurement 
of  the  same.  MASINT  includes  other 
intelligence  sources  such  as  acoustical 
intelligence,  laser  intelligence,  and  nuclear 
intelligence. 

e.  Open  Source  Intelligence  (OSINT). 

OSINT  is  information  of  potential  intelligence 
value  that  is  available  to  the  general  public. 
OSINT  is  available  from  such  sources  as  the 
news  media,  public  affairs  announcements, 
unclassified  government  documents  and 
publications,  public  hearings,  and  contracts 
and  contract-related  material. 


•  COMINT  is  technical  and  intelligence  f  Technical  Intelligence  (TECHINT). 
information  derived  from  foreign  TFCHINT  is  derived  from  the  exploitation 
communications  by  other  than  the  of  foreign  materiel.  It  results  from  the  analysis 
intended  recipients.  Prime  COMINT  of  captured  or  otherwise  obtained  foreign 
sources  include  clear  voice  equipment. 

(nonencrypted)  telephone  and  radio 
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1.  OPSEC  Indicators 

OPSEC  indicators  are  those  friendly  actions 
and  open  sources  of  information  that 
adversary  intelligence  systems  can  potentially 
detect  or  obtain  and  then  interpret  to  derive 
friendly  critical  information. 

2.  Basic  OPSEC  Indicator 
Characteristics 

An  indicator’s  characteristics  are  those 
elements  of  an  action  or  piece  of  information 
that  make  it  potentially  useful  to  an  adversary. 
There  are  five  major  characteristics. 

a.  Signature 

•  A  signature  is  the  characteristic  of  an 
indicator  that  makes  it  identifiable  or 
causes  it  to  stand  out.  Key  signature 
properties  are  uniqueness  and  stability. 
Uncommon  or  unique  features  reduce  the 
ambiguity  of  an  indicator  and  minimize 
the  number  of  other  indicators  that  must 
be  observed  to  confirm  a  single 
indicator’s  significance. 

•  An  indicator’s  signature  stability, 
implying  constant  or  stereotyped 
behavior,  can  allow  an  adversary  to 
anticipate  future  actions.  Varying  the 
pattern  of  behavior  decreases  the 
signature’s  stability  and  thus  increases  the 
ambiguity  of  the  adversary’s  observations. 

•  Procedural  features  are  an  important  part 
of  any  indicator  signature  and  may 
provide  the  greatest  value  to  an  adversary. 
They  identify  how,  when,  and  where  the 
indicator  occurs  and  what  part  it  plays  in 
the  overall  scheme  of  operations  and 
activities. 


b.  Associations 

•  Association  is  the  relationship  of  an 
indicator  to  other  information  or 
activities.  It  is  an  important  key  to  an 
adversary’s  interpretation  of  ongoing 
activity.  Intelligence  analysts 
continuously  compare  their  current 
observations  with  what  has  been  seen  in 
the  past  in  an  effort  to  identify  possible 
relationships. 

•  For  example,  a  distinctive  piece  of 
ground-support  equipment  known  to  be 
used  for  servicing  strategic  bombers 
might  be  observed  at  a  tactical  fighter 
base.  An  intelligence  analyst  could 
conclude  that  a  strategic  bomber  presence 
has  been  or  will  be  established  there.  The 
analyst  will  then  look  for  other  indicators 
associated  with  bombers  to  verify  that 
conclusion. 

•  Another  key  association  deals  with 
continuity  of  actions,  objects,  or  other 
indicators  that  may  register  as  patterns 
to  the  observer  or  analyst.  Such 
continuity  may  not  be  the  result  of 
planned  procedures  but  may  result 
instead  from  repetitive  practices  or 
sequencing  to  accomplish  a  goal. 

•  If,  for  example,  the  intensive  generation 
of  aircraft  sorties  is  always  preceded  by 
a  maintenance  standdown  to  increase 
aircraft  readiness,  detecting  and 
observing  the  standdown  may  allow  the 
adversary  analyst  or  observer  to  predict 
the  subsequent  launch  activity. 
Moreover,  based  on  past  patterns  of  the 
length  of  such  standdowns,  the  analyst 
may  be  able  to  judge  the  scope  of  the 
sortie  generation. 
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•  Another  type  of  association  that  is  useful 
to  intelligence  analysts  is  organizational 
patterns.  Military  units,  for  example,  are 
often  symmetrically  organized.  Thus 
when  some  components  are  detected, 
others  that  are  not  readily  apparent  can 
be  assumed  to  exist. 

•  For  example,  an  intelligence  analyst 
knows  that  a  particular  army’s  infantry 
battalions  are  organized  with  three 
infantry  companies,  a  headquarters 
company,  and  a  weapons  company.  If 
only  the  headquarters  company  and  one 
infantry  company  are  currently  being 
detected,  the  presence  of  the  other  known 
battalion  components  will  be  strongly 
suspected.  Thus  in  some  situations,  a 
pattern  taken  as  a  whole  can  be  treated 
as  a  single  indieator,  simplifying  the 
intelligenee  problem. 

e.  Profiles 

•  Eaeh  functional  activity  generates  its  own 
set  of  more-or-less  unique  signatures  and 
associations.  The  sum  of  these  signatures 
and  associations  is  the  activity’s  profile. 
An  activity’s  profile  is  usually  unique. 
Given  enough  data,  intelligenee  analysts 
ean  determine  the  profile  of  any  activity. 
Most  intelligence  organizations  seek  to 
identify  and  reeord  the  profiles  of  their 
adversary’s  military  aetivities. 

•  The  profile  of  an  aircraft  deployment,  for 
example,  may  be  unique  to  the  aircraft 
type  or  mission.  This  profile,  in  turn,  has 
several  subprofiles  for  the  functional 
activities  needed  to  deploy  the  particular 
mission  aircraft  (e.g.,  fuels,  avionics, 
munitions,  communications,  air  traffic 
control,  supply,  personnel,  and 
transportation). 

•  The  observation  of  a  unique  profile  may 
sometimes  be  the  only  key  that  an 


intelligence  analyst  needs  to  determine 
what  type  of  operation  is  occurring,  thus 
minimizing  the  need  to  look  harder  for 
additional  clues.  Such  unique  profiles 
eut  the  time  needed  to  make  aecurate 
intelligence  estimates.  As  a  result, 
profiles  are  the  analytieal  tools. 

d.  Contrasts 

•  Contrasts  are  any  differences  that  are 
observed  between  an  activity’s  standard 
profile  and  its  most  recent  or  current 
aetions.  Contrasts  are  the  most  reliable 
means  of  detection  because  they  depend 
on  differences  to  established  profiles. 
They  also  are  simpler  to  use  because  they 
need  only  to  be  recognized,  not 
understood. 

•  Deviations  from  normal  profiles  will 
normally  attract  the  interest  of 
intelligence  analysts.  They  will  want  to 
know  why  there  is  a  change  and  attempt 
to  determine  if  the  change  means 
anything  significant. 

•  In  the  previous  example  of  the  distinctive 
bomber-associated  ground  support 
equipment  at  a  fighter  base,  the 
intelligence  observer  might  ask  the 
following  questions. 

••  Have  bombers  been  deployed  at 
fighter  bases  before?  At  this  particular 
fighter  base?  At  several  fighter  bases 
simultaneously? 

••  If  there  have  been  previous  bomber 
deployments,  were  they  routine  or  did 
they  occur  during  some  period  of  crisis? 

••  If  previous  deployments  have  been 
made  to  this  base  or  other  fighter  bases, 
how  many  bomber  aircraft  were 
deployed? 
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••  What  actions  occurred  while  the 
bombers  were  deployed  at  the  fighter 
bases? 

••  What  is  happening  at  other  fighter  and 
bomber  bases?  Is  this  an  isolated  incident 
or  one  of  many  changes  to  normal 
activity  patterns? 

•  Although  the  detection  of  a  single 
contrast  may  not  provide  intelligence 
analysts  with  a  total  understanding  of 
what  is  happening,  it  may  result  in 
increased  intelligence  collection  efforts 
against  an  activity. 

e.  Exposure 

•  Exposure  refers  to  when  and  for  how  long 
an  indicator  is  observed.  The  duration, 
repetition,  and  timing  of  an  indicator’s 
exposure  can  affect  its  relative 
importance  and  meaning.  Limiting  the 
duration  and  repetition  of  exposure 
reduces  the  amount  of  detail  that  can  be 
observed  and  the  associations  that  can  be 
formed. 

•  An  indicator  (object  or  action)  that 
appears  over  a  long  period  of  time  will 
be  assimilated  into  an  overall  profile  and 
assigned  a  meaning.  An  indicator  that 
appears  for  a  short  time  and  does  not 
appear  again  may,  if  it  has  a  high  interest 
value,  persist  in  the  adversary  intelligence 
data  base  or,  if  there  is  little  or  no  interest, 
fade  into  the  background  of  insignificant 
anomalies.  An  indicator  that  appears 
repeatedly  will  be  studied  carefully  as  a 
contrast  to  normal  profiles. 

•  Because  of  a  short  exposure  time,  the 
observer  or  analyst  may  not  detect  key 
characteristics  of  the  indicator  the  first 
time  it  is  seen,  but  he  can  formulate 
questions  and  focus  collection  assets  to 
provide  answers  if  the  indicator  is 
observed  again. 


•  Repetition  of  the  indicator  in  relationship 
to  an  operation,  activity,  or  exercise  will 
add  it  to  the  profile  even  if  the  purpose 
of  the  indicator  is  not  understood  by  the 
adversary.  Indicators  limited  to  a  single 
isolated  exposure  are  difficult  to  detect 
and  evaluate. 

3.  Examples  of  Indicators 

The  following  paragraphs  provide 
examples  of  indicators  that  are  associated  with 
selected  military  activities  and  information. 
This  short  list  only  scratches  the  surface  of 
the  almost  infinite  sources  of  indicators 
associated  with  the  wide  range  of  US  military 
operations  and  activities  that  could  be 
exploited  by  an  adversary.  This  list  is  designed 
primarily  to  stimulate  thinking  about  what 
kinds  of  actions  can  convey  indicators  that 
betray  critical  information  for  specific  friendly 
operations  or  activities. 

a.  Indicators  of  General  Military  Force 
Capabilities 

•  The  presence  of  unusual  type  units  for  a 
given  location,  area,  or  base. 

•  Friendly  reactions  to  adversary  exercises 
or  actual  hostile  actions. 

•  Actions,  information,  or  material 
associating  Reserve  components  with 
specific  commands  or  units  (e.g., 
mobilization  and  assignment  of  Reserve 
personnel  to  units). 

•  Actions,  information,  or  material 
indicating  the  levels  of  unit  manning  as 
well  as  the  state  of  training  and 
experience  of  personnel  assigned. 

•  Actions,  information,  or  material 
revealing  spare  parts  availability  for 
equipment  or  systems. 
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•  Actions,  information,  or  material 
indicating  equipment  or  system 
reliability  (e.g.,  visits  of  technical 
representatives  or  special  repair  teams). 

•  Movement  of  aircraft,  ships,  and  ground 
units  in  response  to  friendly  sensor 
detections  of  hostile  units. 

•  Actions,  information,  or  material 
revealing  tactics,  techniques,  and 
procedures  employed  in  different  types 
of  training  exercises  or  during  equipment 
or  system  operational  tests  and 
evaluations. 

•  Stereotyped  patterns  in  performing  the 
organizational  mission  that  reveal  the 
sequence  of  specific  actions  or  when  they 
are  accomplished. 

b.  Indicators  of  General  C2  Capabilities 

•  Actions,  information,  or  material 
providing  insight  into  the  volume  of 
orders  and  reports  needed  to  accomplish 
tasks. 

•  Actions,  information,  or  material 
showing  unit  subordination  for 
deployment,  mission,  or  task. 

•  Association  of  particular  commanders 
with  patterns  of  behavior  under  stress  or 
in  varying  tactical  situations. 

•  Information  revealing  problems  of 
coordination  between  the  commander’s 
staff  elements. 

•  In  exercises  or  operations,  indications  of 
the  period  between  the  occurrence  of  a 
need  to  act  or  react  and  the  action  taking 
place,  of  consultations  that  occur  with 
higher  commands,  and  of  the  types  of 
actions  initiated. 


•  Unusual  actions  with  no  apparent 
direction  reffected  in  communications. 

c.  General  Indicators  from  Communications 
Usage 

•  Alert  and  maintenance  personnel  using 
handheld  radios  or  testing  aircraft  or 
vehicle  radios. 

•  Establishing  new  communications  nets. 
These  might  reveal  entities  that  have 
intrinsic  significance  for  the  operation  or 
activity  being  planned  or  executed. 
Without  conditioning  to  desensitize 
adversaries,  the  sudden  appearance  of 
new  communications  nets  could  prompt 
tliem  to  implement  additional  intelligence 
collection  to  discern  friendly  activity 
more  accurately. 

•  Suddenly  increasing  traffic  volume  or, 
conversely,  instituting  radio  silence  when 
close  to  the  time  of  starting  an  operation, 
exercise,  or  test.  Without  conditioning, 
unusual  surges  or  periods  of  silence  may 
catch  adversaries’  attention  and,  at  a 
minimum,  prompt  them  to  focus  their 
intelligence  collection  efforts. 

•  Using  static  call  signs  for  particular  units 
or  functions  and  unchanged  or 
infrequently  changed  radio  frequencies. 
This  usage  also  allows  adversaries  to 
monitor  friendly  activity  more  easily  and 
add  to  their  intelligence  data  base  for 
building  an  accurate  appreciation  of 
friendly  activity. 

•  Using  stereotyped  message  characteristics 
that  indicate  particular  types  of  activity 
that  allow  adversaries  to  monitor  friendly 
activity  more  easily. 

•  Requiring  check-in  and  checkout  with 
multiple  control  stations  before,  during, 
and  after  a  mission  (usually  connected 
with  air  operations). 
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d.  Sources  of  Possible  Indicators  for  technologies  to  sensors  and  the  guidance 
Equipment  and  System  Capabilities  components  of  weapons. 

•  Unencrypted  emissions  during  tests  and  e.  Indicators  of  Preparations  for 

exercises.  Operations  or  Activities.  Many  indicators 

may  reveal  data  during  the  preparatory,  as 

•  Public  media,  particularly  technical  compared  to  the  execution,  phase  of 

journals.  operations  or  activities.  Many  deal  with 

logistic  activity. 

•  Budget  data  that  provide  insight  into  the 

objectives  and  scope  ofa  system  research  •  Provisioning  of  special  supplies  for 
and  development  effort  or  the  sustainability  participating  elements . 
of  a  fielded  system. 

•  Requisitioning  unusual  volumes  of 

•  The  equipment  or  system  hardware  itself  supply  items  to  be  filled  by  a  particular 

date. 

•  Information  on  test  and  exercise 

schedules  that  allows  adversaries  to  better  •  Increasing  prepositioning  of  ammunition, 
plan  the  use  of  their  intelligence  fuels,  weapon  stocks,  and  other  classes 
collection  assets.  of  supply. 

•  Deployment  ofunique  units,  targets,  and  •  Embarking  special  units,  installing 

sensor  systems  to  support  tests  associated  special  capabilities,  and  preparing  unit 
with  particular  equipment  or  systems.  equipment  with  special  paint  schemes. 

•  Unusual  or  visible  security  imposed  on  •  Proeuring  large  or  unusual  numbers  of 
particular  development  efforts  that  maps  and  charts  for  specific  locations, 
highlight  their  significance. 

•  Making  medical  arrangements, 

•  Information  indicating  special  manning  mobilizing  medical  personnel,  stockpiling 

for  tests  or  assembly  of  personnel  with  pharmaceuticals  and  blood,  and 
special  skills  from  manufacturers  known  marshalling  medical  equipment. 

to  be  working  on  a  particular  contract. 

•  Focusing  friendly  intelligence  and 

•  Notices  to  mariners  and  airmen  that  reconnaissance  assets  against  a  particular 

might  highlight  test  areas.  area  of  interest. 

•  Stereotyped  use  of  location,  procedures,  •  Requisitioning  or  assigning  increased 

and  sequences  ofactions  when  preparing  number  of  linguists  of  a  particular 

for  and  executing  test  activity  for  specific  language  or  group  of  languages  from  a 

types  of  equipment  or  systems.  particular  region. 

•  Use  of  advertisements  indicating  that  a  •  Initiating  and  maintaining  unusual  liaison 
company  has  a  contract  on  a  classified  with  foreign  nations  for  support, 
system  or  component  of  a  system, 

possesses  technology  of  military  •  Providing  increased  or  tailored  personnel 
significance,  or  has  applied  particular  training, 
principles  of  physics  and  specific 
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•  Holding  rehearsals  to  test  concepts  of  loading  or  guarding  special  munitions  or 
operation.  equipment. 


•  Increasing  the  number  of  trips  and 
conferences  for  senior  officials  and  staff 
members. 

•  Sending  notices  to  airmen  and  mariners 
and  making  airspace  reservations. 

•  Arranging  for  tugs  and  pilots. 

•  Requiring  personnel  on  leave  or  liberty 
to  return  to  their  duty  locations. 

•  Having  unusual  off-limits  restrictions. 

•  Preparing  units  for  combat  operations 
through  equipment  checks  as  well  as 
operational  standdowns  in  order  to 
achieve  a  required  readiness  level  for 
equipment  and  personnel. 

•  Making  billeting  and  transportation 
arrangements  for  particular  personnel  or 
units. 

•  Taking  large-scale  action  to  change  mail 
addresses  or  arrange  for  mail  forwarding. 

•  Posting  such  things  as  supply  delivery, 
personnel  arrival,  transportation,  or 
ordnance  loading  schedules  in  a  routine 
manner  where  personnel  without  a  need- 
to-know  will  have  access. 

•  Storing  boxes  or  equipment  labeled  with 
the  name  of  an  operation  or  activity  or 
with  a  clear  unit  designation  outside  a 
controlled  area. 

•  Employing  uncleared  personnel  to 
handle  materiel  used  only  in  particular 
types  of  operations  or  activities. 

•  Providing  unique  or  highly  visible 
physical  security  arrangements  for 


•  Requesting  unusual  or  increased 
meteorological,  oceanographic,  or  ice 
information  for  a  specific  area. 

•  Setting  up  a  wide-area  network  (WAN) 
over  commercial  lines. 

f.  Sources  of  Indicators  During  the 
Execution  Phase 

•  Unit  and  equipment  departures  from 
normal  bases. 

•  Adversary  radar,  sonar,  or  visual 
detections  of  friendly  units. 

•  Friendly  unit  identifications  through 
COMSEC  violation  or  physical  observation 
of  unit  symbology. 

•  Force  composition  and  tracks  or  routes 
of  advance  that  can  be  provided  by 
emissions  from  units  or  equipment  and 
systems  that  provide  identifying  data. 

•  Stereotyped  procedures;  static  and 
standard  ways  of  composing,  disposing, 
and  controlling  strike  or  defensive 
elements  against  particular  threats;  and 
predictable  reactions  to  enemy  actions. 

•  Alert  of  civilians  in  operational  areas. 

•  Trash  and  garbage  dumped  by  units  or 
from  ships  at  sea  that  might  provide  unit 
identifying  data. 

•  Transportation  of  spare  parts  or  personnel 
to  deploying  or  deployed  units  or  via 
commercial  aircraft  or  ship. 

•  Changes  in  oceanography  high  frequency 
facsimile  transmissions. 
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•  Changes  in  the  activity  over  WAN. 

g.  Indicators  of  Postengagement  Residual 
Capabilities 


•  Assignment  of  new  units  from  other 
areas. 

•  Search  and  rescue  activity. 


•  Repair  and  maintenance  facilities 
schedules. 

•  Urgent  calls  for  maintenance  personnel. 


•  Personnel  orders. 

•  Discussion  of  repair  and  maintenance 
requirements  in  unsecure  areas. 


•  Movement  of  supporting  resources. 

•  Medical  activity. 

•  Unusual  resupply  and  provisioning  of  an 
activity. 


•  Termination  or  modification  of 
procedures  for  reporting  of  unclassified 
meteorological,  oceanographic,  or  ice 
information. 
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APPENDIX  D 

OPERATIONS  SECURITY  MEASURES 


The  following  OPSEC  measures  are 
offered  as  a  guide  only.  Development  of 
specific  OPSEC  measures  is  as  varied  as  the 
specific  vulnerabilities  they  are  designed  to 
offset. 

a.  Operational  and  Logistic  Measures 

•  Randomize  the  performance  of  functions 
and  operational  missions.  Avoid 
repetitive  or  stereotyped  tactics  and 
procedures  for  executing  operations  or 
activities  in  terms  of  time,  place,  event 
sequencing,  formations,  and  C2 
arrangements. 

•  Employ  force  dispositions  and  C2  control 
arrangements  that  conceal  the  location, 
identity,  and  command  relationships  of 
major  units. 

•  Conduct  support  activities  in  a  way  that 
will  not  reveal  intensification  of 
preparations  before  initiating  operations. 

•  Transport  supplies  and  personnel  to 
combat  units  in  a  way  that  conceals  the 
location  and  identity  of  the  combat  units. 

•  Operate  aircraft  at  low  altitude  to  avoid 
radar  detection. 

•  Operate  to  minimize  the  reflective 
surfaces  that  units  or  weapon  systems 
present  to  radars  and  sonars. 

•  Use  darkness  to  mask  deployments  or 
force  generation. 

•  Approach  an  objective  “out  of  the  sun” 
to  prevent  detection. 


b.  Technical  Measures 

•Use  radio  communications  emission 
control,  low-probability-of-intercept 
techniques  and  systems,  traffic  flow 
security,  padding,  flashing  light  or  flag 
hoist,  ultra  high  frequency  relay  via 
aircraft,  burst  transmission  technologies, 
secure  phones,  landline,  and  couriers. 
Limit  use  of  high  fi*equency  radios  and 
directional  super-high  frequency 
transponders. 

•  Control  radar  emission,  operate  at 
reduced  power,  operate  radars  common 
to  many  units,  assign  radar  guard  to  units 
detached  from  formations  or  to  air  early 
warning  aircraft,  and  use  anechoic 
coatings. 

•  Mask  emissions  or  forces  from  radar  or 
visual  detection  by  use  of  terrain  (such 
as  mountains  and  islands). 

•  Maintain  sound  silence  or  operate  at 
reduced  power,  proceed  at  slow  speeds, 
turn  off  selected  equipment,  and  use 
anechoic  coatings. 

•  Use  screen  jamming,  camouflage, 
smoke,  background  noise,  added  sources 
of  heat  or  light,  paint,  or  weather. 

c.  Administrative  Measures 

•  Avoid  bulletin  board,  plan  of  the  day,  or 
planning  schedule  notices  that  reveal 
when  events  will  occur. 

•  Conceal  budgetary  transactions,  supply 
requests  and  actions,  and  arrangements 
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for  services  that  reveal  preparations  for 
activity. 

•  Conceal  the  issuance  of  orders,  the 
movement  of  specially  qualified 
personnel  to  units,  and  the  installation  of 
special  capabilities. 

•  Control  trash  and  garbage  dumping  or 
other  housekeeping  functions  to  conceal 
the  locations  and  identities  of  units. 

•  Follow  normal  leave  and  liberty  policies 
to  the  maximum  extent  possible  before 
an  operation  starts  in  order  to  preserve  a 
sense  of  normalcy. 

•  Ensure  that  personnel  discretely  prepare 
for  their  families’  welfare  in  their  absence 
and  that  their  families  are  sensitized  to 
their  potential  abrupt  departure. 

d.  Military  Deception  In  Support  of 
OPSEC 

•  Military  deception  can  be  an  effective 
OPSEC  measure,  provided  that  prior 
coordination  is  accomplished  when 
actions  will  affect  other  commanders. 
Military  deception  can  be  used  to 
facilitate  the  following. 

••  Cause  adversary  intelligence  to  fail  to 
target  friendly  activity;  collect  against 
targeted  tests,  operations,  exercises,  or 
other  activities;  or  determine  through 
analysis  vital  capabilities  and 
characteristics  of  systems  and  vital 


aspects  of  policies,  procedures,  doctrine, 
and  tactics. 

••  Create  confusion  about,  or  multiple 
interpretations  of,  vital  information 
obtainable  from  open  sources. 

••  Cause  a  loss  of  interest  by  foreign  and 
random  observers  in  test,  operation, 
exercise,  or  other  activity. 

••  Convey  inaccurate  locating  and 
targeting  information  to  opposing  forces. 

•  In  accordance  with  CJCSI  321 1.01  A, 
“Joint  Military  Deception,”  commanders 
are  authorized  to  conduct  military 
deception: 

••  To  support  OPSEC  during  the 
preparation  and  execution  phases  of 
normal  operations,  provided  that  prior 
coordination  is  accomplished  for  actions 
that  will  affect  other  commanders;  and 

••  When  the  commander’s  forces  are 
engaged  or  are  subject  to  imminent 
attack. 

e.  Physical  Destruction  and  Electronic 
Warfare.  During  hostilities,  use  physical 
destruction  and  electronic  attack  against  the 
adversary’s  ability  to  collect  and  process 
information.  C2W  actions  that  can  be  used 
in  support  of  OPSEC  includes  strikes  against 
an  adversary’s  satellites,  SIGINT  sites,  radars, 
fixed  sonar  installations,  reconnaissance 
aircraft,  and  ships. 
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PROCEDURES  FOR  OPSEC  SURVEYS 


1,  General 

a.  The  purpose  of  an  OPSEC  survey  is  to 
thoroughly  examine  an  operation  or  activity 
to  determine  if  adequate  protection  from 
adversary  intelligence  exploitation  exists. 

b.  Ideally,  the  operation  or  activity  being 
surveyed  will  be  using  OPSEC  measures  to 
protect  its  critical  information.  The  OPSEC 
survey  is  used  as  a  check  on  how  effective 
the  measures  are.  The  survey  will  determine 
if  the  critical  information  identified  during  the 
OPSEC  planning  process  is  being  protected. 

c.  A  survey  cannot  be  conducted  until  after 
an  operation  or  activity  has  at  least  identified 
its  critical  information.  Without  a  basis  of 
identified  critical  information,  there  can  be 
no  specific  determination  that  actual  OPSEC 
vulnerabilities  exist. 

2.  Uniqueness 

a.  Each  OPSEC  survey  is  unique.  Surveys 
differ  in  the  nature  of  the  information  requiring 
protection,  the  adversary  collection  capability, 
and  the  environment  of  the  activity  to  be 
surveyed. 

b.  In  combat,  a  survey’s  emphasis  must  be 
on  identifying  operational  indicators  that 
signal  friendly  intentions,  capabilities,  and/or 
limitations  and  that  will  permit  the  adversary 
to  counter  fiiendly  operations  or  reduce  their 
effectiveness. 

c.  In  peacetime,  surveys  generally  seek  to 
correct  weaknesses  that  disclose  information 
useful  to  potential  adversaries  in  the  event  of 
future  conflict.  Many  activities,  such  as 
operational  unit  tests,  practice  alerts,  and 
major  exercises,  are  of  great  interest  to  a 


potential  adversary  because  they  provide 
insight  into  fiiendly  readiness,  plans,  crisis 
procedures,  and  C2  capabilities  that  enhance 
that  adversary’s  long-range  planning. 

3.  OPSEC  Surveys  Versus 
Security  Inspections 

a.  OPSEC  surveys  are  different  from 
security  evaluations  or  inspections.  A  survey 
attempts  to  produce  an  adversary’s  view  of 
the  operation  or  activity  being  surveyed.  A 
security  inspection  seeks  to  determine  if  an 
organization  is  in  compliance  with  the 
appropriate  security  directives  and 
regulations. 

b.  Surveys  are  always  planned  and 
conducted  by  the  organization  responsible  for 
the  operation  or  activity  that  is  to  be  surveyed. 
Inspections  may  be  conducted  without 
warning  by  outside  organizations. 

c.  OPSEC  surveys  are  not  a  check  on  the 
effectiveness  of  an  organization’s  security 
programs  or  its  adherence  to  security 
directives.  In  fact,  survey  teams  will  be 
seeking  to  determine  if  any  security  measures 
are  creating  OPSEC  indicators. 

d.  Surveys  are  not  punitive  inspections,  and 
no  grades  or  evaluations  are  awarded  as  a 
result  of  them.  Surveys  are  not  designed  to 
inspect  individuals  but  are  employed  to 
evaluate  operations  and  systems  used  to 
accomplish  missions. 

e.  To  obtain  accurate  information,  a  survey 
team  must  depend  on  positive  cooperation  and 
assistance  fi*omthe  organizations  participating 
in  the  operation  or  activity  being  surveyed. 
If  team  members  must  question  individuals, 
observe  activities,  and  otherwise  gather  data 
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during  the  course  of  the  survey,  they  will 
inevitably  appear  as  inspectors,  unless  this 
nonpunitive  objective  is  made  clear. 

f.  Although  reports  are  not  provided  to  the 
surveyed  unit’s  higher  headquarters,  OPSEC 
survey  teams  may  forward  to  senior  officials 
the  lessons  learned  on  a  nonattribution  basis. 
The  senior  officials  responsible  for  the 
operation  or  activity  then  decide  to  further 
disseminate  the  survey’s  lessons  learned. 

4.  Types  of  Surveys 

There  are  two  basic  kinds  of  OPSEC 
surveys;  command  and  formal. 

a.  A  command  survey  is  performed  using 
only  command  personnel  and  concentrates  on 
events  within  the  particular  command. 

b.  A  formal  survey  requires  a  survey  team 
composed  of  members  from  inside  and  outside 
the  command  and  will  normally  cross 
command  lines  (after  prior  coordination)  to 


survey  supporting  and  related  operations  and 
activities.  Formal  surveys  are  initiated  by  a 
letter  or  message  stating  the  subject  of  the 
survey,  naming  the  team  leader  and  members, 
and  indicating  when  the  survey  will  be 
conducted.  Commands,  activities,  and 
locations  to  be  visited  may  also  be  listed,  with 
the  notation  that  the  team  may  visit  additional 
locations  if  required  during  the  field  portion 
of  the  survey. 

c.  Both  types  of  surveys  follow  the  same 
basic  sequence  and  procedures  that  are 
established  in  the  annexes  to  this  appendix. 

5.  Survey  Execution 

a.  Careful  prior  planning,  thorough  data 
collection,  and  thoughtful  analysis  of  the 
results  are  the  key  phases  of  an  effective 
OPSEC  survey. 

b.  The  following  annexes  describe  the  three 
phases  of  an  OPSEC  survey. 
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ANNEX  A  TO  APPENDIX  E 

OPSEC  SURVEY  PLANNING  PHASE 


Preparations  for  an  OPSEC  survey  must 
begin  well  in  advance  of  the  field  survey 
phase.  The  required  lead  time  will  depend  on 
the  nature  and  complexity  of  the  operation 
and  activities  to  be  surveyed  (combat 
operations,  peacetime  operational  activity,  or 
other  type  of  operation).  Sufficient  time  must 
be  allotted  in  the  planning  phase  for  a  thorough 
review  of  pertinent  documentation,  for  formal 
and  informal  coordination  and  discussions, 
and  for  the  careful  preparation  of  functional 
outlines.  The  following  actions  normally 
make  up  the  planning  phase. 

a.  Determine  the  Scope  of  the  Survey. 

The  scope  of  the  survey  should  be  defined  at 
the  start  of  the  planning  phase  and  be  limited 
to  manageable  proportions.  Limitations  will 
be  imposed  by  geography,  time,  units  to  be 
observed,  funding,  and  other  practical  matters. 

b.  Select  Team  Members 

•  Regardless  of  the  survey’s  external  or 
internal  focus,  the  team  should  contain 
multidisciplined  expertise.  Survey  team 
members  should  be  selected  for  their 
analytical,  observational,  and  problem¬ 
solving  abilities. 

•  Since  surveys  are  normally  oriented  to 
operations,  the  senior  member  should  be 
selected  from  the  operations  (or 
equivalent)  staff  of  the  commander 
responsible  for  conducting  the  survey. 

•  Typical  team  members  would  represent 
the  functional  areas  of  intelligence, 
security,  communications,  logistics, 
plans,  and  administration.  When 
appropriate,  specialists  from  other 
functional  areas,  such  as  transportation 
and  public  affairs,  will  participate. 


•  When  communications  monitoring  is 
planned  as  part  of  the  survey,  the 
monitoring  group’s  leader  should  be 
designated  as  a  member  of  the  OPSEC 
survey  team.  Team  members  must  be 
brought  together  early  in  the  planning 
phase  to  ensure  timely,  thorough 
accomplishment  of  the  tasks  outlined 
below. 

c.  Become  Familiar  with  Survey 
Procedures.  Designating  team  members  with 
survey  experience  is  advantageous,  but  is 
often  not  possible.  In  such  cases,  team 
members  will  require  familiarization  with 
survey  procedures. 

d.  Determine  the  Adversary  Intelligence 
Threat.  The  adversary  threat  to  the  activities 
to  be  surveyed  must  be  evaluated  carefully 
and  realistically.  An  all-source  threat 
assessment  should  comprehensively  address 
the  adversary  intelligence  capability,  taking 
into  account  not  only  the  adversary’s 
collection  capabilities  (see  Appendix  B,  “The 
Intelligence  Threat”)  but  also  the  adversary’s 
ability  to  exploit  the  collection  results  in  a 
timely  manner. 

e.  Understand  the  Operation  or  Activity 
to  be  Surveyed.  The  team  member's’ 
thorough  understanding  of  the  operation  'or 
activity  to  be  surveyed  is  crucial  to  ensuring 
the  success  of  subsequent  phases  of  the  survey. 
Team  members  should  become  familiar  with 
the  operation  plans,  orders,  standard  operating 
procedures,  or  other  directives  bearing  on  the 
surveyed  operation  or  activity.  This  initial 
review  familiarizes  team  members  with  the 
mission  and  concept  of  operation  and 
identifies  most  of  the  organizations 
participating  in  the  surveyed  activity  (others 
may  be  identified  as  the  survey  progresses). 
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f.  Conduct  Empirical  Studies 

•  Empirical  studies  simulate  aspects  of  the 
adversary  intelligence  threat  and  support 
vulnerability  findings.  These  studies  also 
help  the  survey  team  identify 
vulnerabilities  that  cannot  be  determined 
through  interviews  and  observation.  The 
results  of  these  studies  are  useful  to  the 
survey  team  during  the  field  or  analytic 
phase  of  the  survey. 

•  An  example  of  an  empirical  study  is 
signals  monitoring.  Computer  modeling 
or  other  laboratory  simulations  of  the 
enemy  threat  may  also  be  useful  to  the 
survey  team.  These  studies  are  usually 
performed  by  organizations  external  to 
the  one  sponsoring  the  OPSEC  survey 
team.  Arrangements  for  their  use  should 
be  made  as  far  in  advance  of  the  survey 
as  possible. 

g.  Develop  a  Functional  Outline 

•  A  basic  OPSEC  survey  technique 
involves  the  construction  of  a  chronology 
of  events  that  are  expected  to  occur  in 
the  surveyed  operation  or  activity.  Events 
are  assembled  sequentially,  thus  creating 
a  timeline  that  describes  in  detail  the 
activities  or  plans  of  an  operation  or 
activity. 

•  Chronologies  should  first  be  constructed 
for  each  separate  functional  area,  such 
as  operations,  communications,  logistics, 
or  administration.  This  functional 
approach  aids  the  team  members  in 
defining  their  separate  areas  of  inquiry 
during  the  field  or  data  collection  phase 
of  the  survey.  Later,  the  functional 
outlines  can  be  correlated  with  each  other 
to  build  an  integrated  chronology  of  the 
entire  operation  or  activity  (see  Tab  A, 
“Composite  OPSEC  Profile  for  Combat 
Operations”). 


•  After  the  chronology  is  assembled, 
vulnerabilities  can  be  identified  in  light 
of  the  known  or  projected  threat. 

•  During  the  initial  review  of  operation 
plans,  orders,  and  procedures,  individual 
team  members  can  begin  to  develop 
functionally  oriented  outlines  for  their 
areas  of  interest.  Initially,  the  outlines 
will  be  skeletal  projections,  in  a  narrative, 
table,  or  graph  format,  of  what  is  expected 
to  occur  in  the  chronology  for  a  particular 
functional  area  (see  Tabs  B  through  F). 

•  Such  projections  can  serve  as  planning 
aids  for  the  subsequent  field  survey 
phase.  For  example,  units  and  facilities 
associated  with  each  of  the  events  can  be 
identified  and  geographically  grouped  to 
aid  in  planning  the  travel  itinerary  of  team 
members  during  the  field  survey. 
Collectively,  the  initial  functional 
outlines  provide  a  basis  for  planning  the 
field  survey  phase  and  constitute  a  basis 
for  observation  and  interviews. 

•  During  the  field  survey  phase,  team 
members  will  acquire  additional 
information  through  observation, 
interviews,  and  other  data-collection 
techniques,  enabling  ilirthcr  development 
and  refinement  of  the  functional  outlines. 

•  Collectively,  the  outlines  project  a  time- 
phased  picture  of  the  events  associated 
with  the  planning,  preparation,  execution, 
and  conclusion  of  the  operation  or 
activity.  The  outlines  also  provide  an 
analytic  basis  for  identifying  events  and 
activities  that  are  vulnerable  to  adversary 
exploitation. 

h.  Determine  Preliminary  Friendly 
Vulnerabilities.  After  the  adversary 
intelligence  threat  and  the  OPSEC  indicators 
are  determined,  a  subjective  evaluation  mu.st 
be  made  of  the  potential  friendly 
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vulnerabilities.  A  vulnerability  (e.g.,  a 
detectable,  exploitable  event)  may  or  may  not 
carry  a  security  classification  at  the  time  of 
its  identification,  but  such  preliminary 
vulnerabilities  must  be  protected  from 
disclosure  by  administrative  or  security 
controls.  These  preliminary  friendly 
vulnerabilities  will  be  refined  in  later  stages 
of  the  OPSEC  survey. 

i.  Announce  the  Survey 

•  After  team  members  are  selected  and  are 
familiar  with  the  operation  or  activity  to 
be  surveyed,  the  organization  conducting 
the  survey  should  inform  its  subordinate 
and  supporting  organizations  that  a 
survey  will  be  conducted  so  that 
preparations  can  be  made  to  support  the 
team  during  the  field  survey  phase. 


OPSEC  Survey  Planning  Phase 

•  The  following  information  should  be 
included: 

•*  Survey  purpose  and  scope. 

••  List  of  team  members  and  their 
clearances. 

••  List  of  required  briefings  and 
orientations. 

••  Timeframe  involved. 

••  Administrative  support  requirements. 

••  Signals  security  (SIGSEC)  monitoring 
support  requirements  (if  needed). 
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TAB  A  TO  ANNEX  A  TO  APPENDIX  E 

COMPOSITE  OPSEC  PROFILE  FOR  COMBAT  OPERATIONS 


Figure  E-A-A-1  provides  a  sample  collected  during  an  OPSEC  survey.  OPSEC 
composite  OPSEC  profile  for  combat  survey  personnel  should  use  a  composite 
operations.  As  illustrated  by  this  sample,  a  OPSEC  profile  or  similar  tool  to  assist  in 
profile  can  be  constmcted  to  display  the  event-  identifying  unit  or  mission  OPSEC  indicators, 
time-agency  data  of  significant  information 
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TAB  B  TO  ANNEX  A  TO  APPENDIX  E 
FUNCTIONAL  OUTLINE  AND  PROFILE  GUIDELINE 
FOR  INTELLIGENCE  COLLECTION  OPERATIONS 


The  completed  profile  reflects  a  picture  of 
the  intelligence  collection  effort.  Intelligence 
collection  is  normally  one  of  the  first 
functional  areas  to  present  indicators  of  an 
impending  operation  or  activity. 

a.  Planned  Event  Sequence.  See 
intelligence  collection  plan  prepared  by 
intelligence  staff  element. 

b.  Actual  Event  Sequence.  Observe 
events  in  the  operation  center. 

c.  Analysis.  Determine  any  OPSEC 
vulnerabilities.  If  vulnerabilities  exist, 
determine  whether  they  exist  because  of  an 
error  or  because  they  are  the  result  of  normal 
procedures. 

d.  Examples  of  Typical  Indicators 

•  Appearance  of  specialized  intelligence 
collection  equipment  in  a  particular  area. 


•  Increased  traffic  on  intelligence 
communications  nets. 

•  Increased  manning  levels  and/or  work 
hours  in  intelligence  facilities. 

•  Increased  research  activity  by  known 
intelligence  activities  and  personnel  in 
libraries  and  electronic  data  bases. 

•  Increased  activity  of  friendly  agent  nets. 

•  Increased  levels  of  activity  by  airborne 
intelligence  systems. 

•  Alterations  in  the  orbits  of  intelligence 
satellites. 

•  Interviews  with  nongovernmental  subject 
matter  experts  conducted  by  intelligence 
personnel. 

•  Requests  for  maps  and  other  topographic 
material. 
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TAB  C  TO  ANNEX  A  TO  APPENDIX  E 
FUNCTIONAL  OUTLINE  AND  PROFILE  GUIDELINE 
FOR  LOGISTICS 


The  completed  logistic  profile  presents  a 
picture  of  logistic  activities  conducted  in 
preparation  for  an  impending  operation.  As 
in  the  administration  function,  the  long  lead 
time  for  some  preparations  gives  early 
warning  of  forthcoming  operations  if  events 
are  compromised. 

a.  Planned  Event  Sequence.  See  logistic 
annex  to  OPLAN. 

b.  Actual  Event  Sequence.  Observation, 
interviews. 

c.  Analysis.  As  in  other  functional  areas. 

d.  Examples  of  Typical  Indicators 

•  Special  equipment  issue. 

•  Prepositioning  of  equipment  and 
supplies. 


•  Increased  weapons  and  vehicle 
maintenance. 

•  Petroleum,  oils,  and  lubricants  stockpiling. 

•  Upgrading  lines  of  communications. 

•  Ammunition  stockpiling. 

•  Delivery  of  special  munitions  and 
uncommon  munitions  (discloses  possible 
nature  of  operation). 

•  Arrival  of  new  logistic  units  and 
personnel. 

•  Increased  requisition  of  supplies. 

•  Increased  traffic  on  logistics  communications 
nets. 

•  Changes  in  normal  delivery  patterns. 
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TAB  D  TO  ANNEX  A  TO  APPENDIX  E 
FUNCTIONAL  OUTLINE  AND  PROFILE  GUIDELINE 
FOR  COMMUNICATIONS 


In  addition  to  presenting  a  pieture  of  its  own 
fimctional  area,  friendly  communications  also 
reflect  all  other  functional  areas. 
Communications  surveillance  and 
communications  logs  for  all  functional  nets 
are  important  tools  in  evaluating  this 
functional  area  as  well  as  other  functions 
involved. 

a.  Planned  Event  Sequence.  OPLAN, 
operation  order  (OPORD),  signal  operation 
instructions,  or  standing  signal  instruction. 

b.  Actual  Event  Sequence.  Communications 
monitoring  and  communications  logs. 

c.  Analysis.  As  in  other  functional  areas. 

d.  Examples  of  Typical  Indicators 

•  Increased  radio,  teletype,  and  telephone 
traffic. 


•  Increased  communications  checks. 

•  Appearance  of  new  stations  in  net. 

•  New  frequency  and  call-sign 
assignments. 

•  New  codes  and  authenticators. 

•  Radio  silence. 

•  Changing  callup  patterns. 

•  Use  of  maintenance  frequencies  to  test 
equipment. 

•  Communications  command  post 
exercises. 

•  Appearance  of  different  cryptographic 
equipment  and  materials. 
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TAB  E  TO  ANNEX  A  TO  APPENDIX  E 
FUNCTIONAL  OUTLINE  AND  PROFILE  GUIDELINE 
FOR  OPERATIONS 


The  completed  profile  of  operational 
activities  reflects  events  associated  with 
tactical  combat  units  as  they  prepare  for  an 
operation. 

a.  Planned  Event  Sequence.  OPLAN, 
OPORD,  standing  operating  procedure 
(SOP). 

b.  Actual  Event  Sequence.  Observations, 
reports,  messages,  interviews. 

c.  Analysis.  As  in  other  functional  areas. 

d.  Examples  of  Typical  Indicators 

•  Rehearsals  and  drills. 

•  Special-tactics  refresher  training. 

•  Appearance  of  special-purpose  units 


(bridge  companies,  forward  air  controllers, 
pathfinders,  mobile  weather  units). 

•  Pre-positioning  of  artillery  and  aviation 
units. 

•  Artillery  registration  in  new  objective 
area. 

•  Complete  cessation  of  activity  in  area  in 
which  reconnaissance  activity  previously 
took  place. 

•  Appearance  of  new  attached  units. 

•  Issuance  of  new  equipment. 

•  Changes  in  major  unit  leadership. 

•  Repositioning  of  maneuver  units. 
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TAB  F  TO  ANNEX  A  TO  APPENDIX  E 
FUNCTIONAL  OUTLINE  AND  PROFILE  GUIDELINE 
FOR  ADMINISTRATION  AND  SUPPORT 


The  completed  profile  of  administrative  and 
support  events  shows  activities  taking  place 
before  the  operation,  thereby  giving  advance 
warning. 

a.  Planned  Event  Sequence.  Derive  from 
unit  SOPs  and  administrative  orders. 

b.  Actual  Event  Schedule.  Observations 
and  interviews. 

c.  Analysis.  As  in  other  fimctional  areas. 

d.  Examples  of  Typical  Indicators 

•  Release  of  groups  of  personnel  or 
complete  units  for  personal  affairs. 


•  Runs  on  exchanges  for  personal  articles, 
cleaning,  and  other  items. 

•  Changes  to  wake-up  and  mess  schedules. 

•  Changes  to  mailing  addresses. 

•  New  unit  designators  on  mail. 

•  Emergency  personnel  requisitions  and 
fills  for  critical  skills. 

•  Medical  supply  stockpiling. 

•  Emergency  recall  of  personnel  on  pass 
and  leave. 
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ANNEX  B  TO  APPENDIX  E 

FIELD  SURVEY  PHASE 


As  noted  previously,  data  collection  begins 
in  the  planning  phase  with  a  review  of 
associated  documentation.  During  the  field 
survey  phase,  interviews  with  personnel 
directly  involved  in  the  operation,  together 
with  observations  and  document  collection, 
are  the  primary  means  of  data  collection.  The 
following  actions  are  normally  accomplished 
during  the  field  survey  phase. 

a.  Command  Briefing  on  Operation  to 
be  Surveyed.  This  briefing  is  presented  to 
the  OP  SEC  survey  team  by  the  command 
directing  the  forces  or  assets  involved  in  the 
operation  or  activity  being  surveyed.  The 
puipose  of  the  briefing  is  to  provide  the  survey 
team  with  an  overview  of  the  operation  from 
the  command’s  point  of  view.  Team  members 
should  use  this  opportunity  to  clarify 
remaining  questions  about  the  information 
developed  in  the  planning  phase. 

b.  OPSEC  Survey  Team  Briefing.  This 
briefing  is  presented  by  the  chief  of  the  survey 
team  to  the  commander  and  principal  staff 
officers  of  the  surveyed  organization.  The 
briefing  may  be  either  a  formal  presentation 
or  an  informal  discussion.  The  objective  is  to 
inform  the  commander  and  the  staff  of  how 
the  survey  will  be  conducted.  The  briefing 
should  include  a  summary  of  the  hostile  threat 
and  the  vulnerability  assessment  developed 
during  the  planning  phase.  The  staff  should 
be  asked  to  comment  on  the  validity  of  this 
assessment.  Results  of  previous  OPSEC 
surveys  of  similar  activities  may  be 
summarized. 

c.  Data  Collection  and  Functional 
Outline  Refinement 

•  Data  Collection 


••  During  the  field  survey  phase,  data  are 
collected  through  observation  of 
activities,  document  collection,  and 
personnel  interviews.  Data  may  also  be 
acquired  through  concurrent  ongoing 
empirical  data  collection,  such  as 
SIGSEC  monitoring. 

••  Team  members  must  be  alert  to 
differences  between  what  they  have  read, 
what  they  have  assumed  to  be  the 
situation,  what  they  have  been  told  in  the 
command  briefing,  and  what  they 
observe  and  are  told  by  personnel 
participating  in  the  operation. 
Conflicting  data  are  to  be  expected. 

••  While  observations  can  verity  the 
occurrence,  sequence,  and  exact  timing 
of  events,  much  essential  information 
must  be  gathered  from  interviews.  (1) 
Functional  outlines  should  be  reviewed 
before  and  after  interviews  to  ensure  that 
all  pertinent  points  are  covered.  Specifics 
on  how,  when,  and  where  people 
accomplish  their  tasks,  and  how  these 
tasks  relate  to  the  planned  and  observed 
sequence  of  events,  are  recorded  in  order 
to  document  activities  in  a  logical 
sequence.  (2)  Team  members  should 
assure  interviewees  that  all  sources  of 
information  will  be  protected  by  a 
nonattribution  policy.  (3)  Interviews  are 
best  conducted  by  two  team  members. 
(4)  Facts  to  be  recorded  during  or  soon 
after  the  interview  normally  include:  (a) 
Identification  and  purpose  of  the 
interview;  (b)  Description  of  the 
positions  occupied  by  the  persons  being 
interviewed;  (c)  Details  of  exactly  what 
tasks  the  individuals  perform  and  how, 
when,  and  where  they  perform  them  with 
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a  view  toward  determining  what 
information  they  receive,  handle,  or 
generate,  and  what  they  do  with  it;  and 
(d)  Whether  the  individuals’  actions 
reflect  an  awareness  of  a  hostile 
intelligence  collection  threat. 

•  Functional  Outline  Refinement 

••  As  indicated  earlier,  each  team 
member  should  have  a  basic  functional 
outline  to  direct  data  collection  efforts  at 
the  beginning  of  the  field  survey  phase. 
The  basic  outline  will  be  modified  during 
this  phase  to  reflect  new  information 
obtained  by  observation  and  interview 
and  will  ultimately  become  a  profile  of 
actual  events. 

••  Each  team  member  should  be  familiar 
with  the  outlines  used  by  the  other 
members  of  the  survey  team  and  should 
be  alert  for  information  that  might  affect 
them.  An  interview  in  the  communications 
area,  for  example,  might  disclose 
information  that  would  result  in  a  change 
to  the  outline  being  developed  for 
operations;  or  an  observation  in  one 
geographic  location  could  affect  an 
outline  being  followed  up  in  another. 
Also,  to  permit  followup  elsewhere,  all 
outlines  should  try  to  reflect  the 
information  generated  and  the  flow  at 
each  location  where  data  are  collected. 

••  As  data  are  accumulated  through 
observation  and  interviews,  incorporation 
of  such  data  into  the  basic  functional 
outline  changes  the  original  list  of 
projected  events  into  a  profile  of  actual 
events.  The  functional  outline  then 
becomes  a  chronological  record  of  what 
actually  was  done,  where,  who  did  it,  and 
how  and  why  it  was  done.  The  outline 
should  also  reflect  an  assessment  of  the 
vulnerability  of  each  event  to  the  known 
or  suspected  hostile  intelligence  threat. 


••  Tentative  findings  will  begin  to 
emerge  as  data  collection  proceeds  and 
information  is  reviewed  and  compared. 
The  findings  should  be  confirmed  and 
fiilly  documented  as  quickly  as  possible. 

••  If  a  finding  is  considered  to  have 
serious  mission  impact,  it  should  be  made 
known  to  the  commander  responsible  for 
the  operation  in  order  to  permit  early 
corrective  actions. 

••  Development  of  findings  during  the 
field  survey  phase  ensures  access  to 
supporting  data  and  precludes  the  need 
to  reconstruct  evidence  after  the  team  has 
left  the  scene.  Following  this  procedure, 
the  basic  findings  and  supporting  data  of 
the  final  survey  report  will  be  well 
developed  before  the  end  of  the  field 
survey  phase.  Final  development  and 
production  of  the  survey  report  can  then 
proceed  immediately  upon  the  team’s 
return  to  home  station. 

d.  Team  Employment 

•  The  complexity,  size,  and  duration  of  the 
surveyed  operation  or  activity  will 
determine  the  general  employment  of  the 
survey  team.  Tentative  locations  for  data 
collection,  developed  during  the  planning 
phase,  provide  initial  indications  of  how 
and  where  to  employ  the  team. 

•  It  is  rarely  possible,  however,  to  plan 
employment  in  detail  before  the  field 
survey  phase.  A  limited,  short  duration 
operation  with  few  participating  elements 
may  permit  concentrating  the  team  in 
one,  or  a  very  few,  locations.  Larger  and 
longer  operations  may  require  complete 
dispersal  of  the  team,  movement  of  the 
entire  team  from  one  location  to  another, 
or  both,  over  a  substantial  period  of  time. 
The  most  reliable  guideline  for  the  team 
chief  in  determining  how  to  employ  the 
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Field  Survey  Phase 


team  is  to  reassemble  it  daily  to  assess 
progress,  compare  data,  and  coordinate 
the  direction  of  the  survey. 

•  The  duration  of  the  field  survey  phase  is 
established  during  the  planning  phase  and 
depends  on  how  rapidly  data  are 
collected.  Many  surveys  have  required 
30  days  or  more  in  the  field.  Less 
comprehensive  ones  might  require  a 
week  or  10  days.  The  proximity  of  data 
collection  locations  to  each  other,  number 
of  such  locations,  transportation 
availability,  and  degree  of  difficulty 
experienced  in  resolving  conflicting  data 
are  some  of  the  factors  affecting  duration 
of  the  field  survey  phase. 

e.  OPSEC  Survey  Team  Exit  Briefing 

•  An  exit  briefing  should  be  presented  to 
the  commander  before  the  team  leaves  a 
command,  regardless  of  previous  reports 
or  tentative  findings.  Like  the  entrance 


briefing,  the  exit  briefing  can  be  an 
informal  discussion  with  the  commander 
or  a  formal  briefing  for  the  commander 
and  the  staff. 

•  The  tentative  nature  of  survey  findings 
should  be  emphasized.  Even  those  that 
appear  to  be  firm  may  be  altered  by  the 
final  data  review  as  the  survey  report  is 
prepared.  Because  preparation  of  the 
written  report  may  take  some  time,  the 
exit  briefing  can  serve  as  an  interim  basis 
for  further  consideration  and  possible 
action  by  the  commander. 

•  The  distribution  of  the  final  written  report 
should  be  clearly  stated  during  the  exit 
briefing.  Normally,  the  report  will  be 
provided  directly  to  the  commander. 
Some  commands  have  found  it  useful  to 
forward  an  interim  report  to  the  surveyed 
commander  for  comments  before 
proceeding  with  the  final  version. 


E-B-3 


Annex  B  to  Appendix  E 


Intentionally  Blank 


E-B-4 


Joint  Pub  3-54 


ANNEX  C  TO  APPENDIX  E 

ANALYSIS  AND  REPORTING  PHASE 


During  this  phase,  the  OPSEC  team 
correlates  the  data  acquired  by  individual 
members  with  information  from  any  empirical 
studies  conducted  in  conjunction  with  the 
survey 

a.  Correlation  of  Data 

•  Correlation  of  Functional  Outlines. 

When  the  separate  chronology  outlines 
for  each  functional  area  are  correlated, 
the  chronology  of  events  for  the  operation 
or  activity  as  a  whole  will  emerge. 
During  the  field  survey  or  analytic 
phases,  conflicts  of  data  must  be  clarified. 

•  Functional  Outlines.  The  purpose  of 
constructing  the  functional  outlines  is  to 
describe  the  time-phased  unfolding  of  the 
operation  or  activity;  to  depict  the  manner 
in  \\bich  separate  commands,  oiganizations, 
and  activities  interact  and  perform  their 
roles  in  the  operation  or  activity;  and  to 
trace  the  flow  of  information  through 
electrical  and  nonelectrical  communications 
media  from  its  origin  to  its  ultimate 
recipients.  It  is  important  that  the  team 
members  present  the  information  in  a 
manner  that  facilitates  analysis.  The  net 
result  of  the  correlation  will  be  a  portrayal 
of  the  entire  operation  or  activity. 

•  Correlation  of  Empirical  Data.  In 

addition  to  correlating  data  acquired  from 
the  observations  of  individual  team 
members,  the  survey  team  may  also  use 
relevant,  empirically  derived  data  to 
refine  individual  functional  outlines. 
More  importantly,  these  data  can  also 
verify  vulnerabilities  that  would 
otherwise  be  exceedingly  speculative  or 
tenuous.  Empirical  data  are  extremely 
important  to  a  comprehensive  survey. 


b.  Identification  of  Vulnerabilities 

•  The  correlation  and  analysis  of  data  help 
the  team  to  refine  the  previously 
identified  preliminary  vulnerabilities  or 
isolate  new  ones.  This  analysis  is 
accomplished  in  a  manner  similar  to  the 
way  in  which  adversaries  would  process 
information  through  their  intelligence 
systems. 

•  Indicators  that  are  potentially  observable 
are  identified  as  vulnerabilities. 
Vulnerabilities  point  out  situations  that 
an  adversary  may  be  able  to  exploit.  The 
key  factors  of  a  vulnerability  are 
observable  indicators  and  an  intelligence 
collection  threat  to  those  indicators. 

•  The  degree  of  risk  to  the  friendly  mission 
depends  on  the  adversary’s  ability  to  react 
to  the  situation  in  sufficient  time  to 
degrade  friendly  mission  or  task 
effectiveness. 

c.  OPSEC  Survey  Report.  The  report  of 
the  OPSEC  survey  is  addressed  to  the 
commander  of  the  surveyed  operation  or 
activity.  Lengthy  reports  (more  than  1 5  pages) 
should  be  accompanied  by  an  executive 
summary. 

•  There  is  no  special  format  for  OPSEC 
survey  reports;  a  suggested  format  is 
found  in  Tab  A,  “Suggested  Format  for 
Final  OPSEC  Survey  Format.” 
Whatever  the  format,  the  report  should 
provide  a  discussion  of  identified  critical 
information,  indicators,  adversaries  and 
their  intelligence  capabilities,  OPSEC 
vulnerabilities,  risk  analysis,  and 
recommended  OPSEC  measures  to 
eliminate  or  reduce  the  vulnerabilities. 
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Although  some  vulnerabilities  may  be 
virtually  impossible  to  eliminate  or 
reduce,  they  should  be  included  in  the 
report  to  enable  commanders  to  assess 
their  operation  or  activity  more 
realistically. 

•  Each  report  should  contain  a  threat 
statement.  Its  length  and  classification 
need  only  be  adequate  to  substantiate  the 
vulnerabilities  (or  actual  sources  of 
adversary  information)  described  in  the 
report.  The  statement  may  be  included 
in  the  main  body  of  the  report  or  as  an 
annex  to  it.  Portions  of  the  threat  that 
apply  to  a  particular  vulnerability  finding 
may  be  concisely  stated  as  substantiation 
in  a  paragraph  preceding  or  following  the 
explanation  of  the  observation.  If  the 
threat  statement  is  so  classified  that  it  will 
impede  the  desired  distribution  and 
handling,  the  statement,  or  parts  of  it, 
should  be  affixed  as  an  annex  that  can  be 
included  only  in  copies  of  the  survey 
report  provided  to  appropriately  cleared 
recipients. 

•  The  section  that  delineates  vulnerabilities 
can  be  presented  in  a  sequence  that 
correlates  with  their  significance,  in  an 
order  that  coincides  with  their  appearance 
in  the  chronological  unfolding  of  the 
surveyed  operation  or  activity,  or 
grouped  together  according  to  functional 
area  (logistics,  communications, 
personnel).  A  particular  vulnerability  can 
be  introduced  by  a  headline  followed  by 
an  adequate  description  of  the  finding  and 
accompanied  by  identification  of  that 
portion  of  the  operation  or  activity  that 
includes  the  vulnerability.  As  stated 
earlier,  a  vulnerability  observation  may 
also  include  relevant  threat  references. 

•  If  possible,  OPSEC  teams  should  include 
recommendations  for  corrective  actions 
in  the  report.  However,  the  team  is  not 
compelled  to  accompany  each  vulnerability 


finding  with  a  recommendation.  In 
some  situations,  the  team  may  not  be 
qualified  to  devise  the  corrective  action;  in 
others,  it  may  not  have  an  appreciation  of 
the  limitations  in  resources  and  options  of 
a  particular  command.  It  may  sometimes 
be  more  effective  for  the  team  to  present 
the  recommendation  informally  rather  than 
including  it  in  the  survey  report. 
Recommendations  of  the  OPSEC  team 
may  be  particularly  valuable  in  situations 
in  which  a  vulnerability  crosses  command 
lines.  Ultimately,  commanders  or  the 
responsible  officials  must  assess  the  effect 
of  possible  adversary  exploitation  of 
vulnerabilities  on  the  effectiveness  of  their 
operation  or  activity.  They  must  then  decide 
between  implementing  corrective  actions 
or  accepting  the  risk  posed  by  the 
vulnerability. 

•  Appendixes  and  annexes  to  OPSEC 
survey  reports  may  be  added  to  support 
the  vulnerability  findings  and 
conclusions.  Sections,  such  as  a  threat 
annex,  may  include  empirical  studies  (or 
parts  of  them).  Maps,  diagrams,  and 
other  illustrative  materials  are  some  ways 
to  substantiate  OPSEC  vulnerabilities. 

•  The  report  may  end  with  a  conclusion  or 
summary  of  the  survey  and  its  findings. 
The  summary  should  not  include 
judgments  about  compliance  with 
standing  security  practices  of  the 
organizations.  Such  judgments  are  the 
purview  of  security  disciplines. 

•  Distribution  of  the  survey  team’s  report 
should  be  limited  to  the  principal 
commands  responsible  for  the  surveyed 
operation  or  activity.  After  the 
commands  have  had  time  to  assess  the 
report  and  take  corrective  actions,  they 
can  consider  additional  distribution. 
Abstracts  from  the  report  may  be 
provided  for  lessons-leamed  documents 
or  data  bases  on  a  nonattribution  basis. 
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Because  they  contain  vulnerability 
information,  OPSEC  survey  reports 
must  be  controlled  from  release  to 
unauthorized  persons  or  agencies. 
Affected  portions  of  the  report  must 
be  controlled  in  accordance  with 
applicable  security  classification 
guides.  For  those  portions  of  the  report 


not  controlled  by  security  classification 
guides,  administrative  control  of  the 
release  of  survey  report  information 
must  be  considered.  Likewise,  the 
notes,  interviews,  and  raw  data  used 
to  build  a  survey  report  must  be  subject 
to  the  same  controls  as  the  finished 
report. 
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TAB  A  TO  ANNEX  C  TO  APPENDIX  E 

SUGGESTED  FORMAT  FOR  FINAL  OPSEC  SURVEY  REPORT 

1.  Overview  3.  Analysis,  Conclusions,  and 

Findings 


a.  Background.  Address  the  purpose  and 
scope  of  the  survey  as  well  as  the  results  of 
the  threat  and  vulnerability  assessments. 

b.  Conduct  of  Survey.  Brief  discussion 
of  methodology,  team  composition,  major 
commands  visited,  and  timeframe  of  survey. 

c.  Critical  Information 

d.  Threat 

2.  Summary  of  Significant 
Findings 


This  is  the  body  of  the  report.  Discussions 
and  findings  may  be  listed  chronologically, 
by  command,  or  chronologically  within 
commands. 

4.  Suggested  Format  for  Each 
Finding 

a.  Observation 

b.  Analysis  and  discussion 

c.  Conclusion  or  recommendation 
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ADMINISTRATIVE  INSTRUCTIONS 


1.  User  Comments 

Users  in  the  field  are  highly  encouraged  to  submit  comments  on  this  publication  to  the 
Joint  Warfighting  Center,  Attn:  Doctrine  Division,  Fenwick  Road,  Bldg  96,  Fort  Monroe, 
VA  23651-5000.  These  comments  should  address  content  (accuracy,  usefulness, 
consistency,  and  organization),  writing,  and  appearance. 

2.  Authorship 

The  lead  agent  and  the  Joint  Staff  doctrine  sponsor  for  this  publication  is  the  Director  for 
Operations  (J-3). 

3.  Supersession 


This  publication  supersedes  Joint  Pub  54,  22  August  1991,  “Joint  Doctrine  for 
Operations  Security,”  with  Change  1. 

4.  Change  Recommendations 


a.  Recommendations  for  urgent  changes  to  this  publication  should  be  submitted: 

TO:  JOINT  STAFF  WASHINGTON  DC//J33/STOD// 

INFO:  JOINT  STAFF  WASHINGTON  DC//J7-JDD// 

Routine  changes  should  be  submitted  to  the  Director  for  Operational  Plans  and 

Interoperability  (J-7),  JDD,  7000  Joint  Staff  Pentagon,  Washington,  D.C.  203 1 8-7000. 

b.  When  a  Joint  Staff  directorate  submits  a  proposal  to  the  Chairman  of  the  Joint 
Chiefs  of  Staff  that  would  change  source  document  information  reflected  in  this 
publication,  that  directorate  will  include  a  proposed  change  to  this  publication  as  an 
enclosure  to  its  proposal.  The  Military  Services  and  other  organizations  are  requested 
to  notify  the  Director,  J-7,  Joint  Staff,  when  changes  to  source  documents  reflected  in 
this  publication  are  initiated. 

c.  Record  of  Changes: 

CHANGE  COPY  DATE  OF  DATE  POSTED 

NUMBER  NUMBER  CHANGE  ENTERED  BY  REMARKS 
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5.  Distribution 


a.  Additional  copies  of  this  publication  can  be  obtained  through  Service  publication 
centers. 

b.  Only  approved  pubs  and  test  pubs  are  releasable  outside  the  combatant  commands, 
Services,  and  Joint  Staff.  Release  of  any  classified  joint  publication  to  foreign 
governments  or  foreign  nationals  must  be  requested  through  the  local  embassy 
(Defense  Attache  Office)  to  DIA  Foreign  Liaison  Office,  PSS,  Room  1 A674,  Pentagon, 
Washington,  D.C.  20301-7400. 

c.  Additional  copies  should  be  obtained  from  the  Military  Service  assigned 
administrative  support  responsibility  by  DOD  Directive  5100.3,  1  November  1988, 
“Support  of  the  Headquarters  of  Unified,  Specified,  and  Subordinate  Joint  Commands.” 


By  Military  Services: 


Army: 


Air  Force: 


Navy: 


US  Army  AG  Publication  Center 
2800  Eastern  Boulevard 
Baltimore,  MD  21220-2898 

Air  Force  Publications  Distribution  Center 
2800  Eastern  Boulevard 
Baltimore,  MD  21220-2896 

CO,  Naval  Inventory  Control  Point 
700  Robbins  Avenue 
Bldg  1,  Customer  Service 
Philadelphia,  PA  19111-5099 


Marine  Corps:  Marine  Corps  Logistics  Base 
Albany,  GA  31704-5000 


Coast  Guard:  Coast  Guard  Headquarters,  COMDT  (G-OPD) 

2100  2nd  Street,  SW 
Washington,  D.C.  20593-0001 


d.  Local  reproduction  is  authorized  and  access  to  unclassified  publications  is 
unrestricted.  However,  access  to  and  reproduction  authorization  for  classified  joint 
publications  must  be  in  accordance  with  DOD  Regulation  5200. 1-R. 
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PART  I— ABBREVIATIONS  AND  ACRONYMS 


AOI 

area  of  interest 

C2 

C2W 

CJCS 

COA 

COMINT 

COMSEC 

CONPLAN 

command  and  control 
command  and  control  warfare 

Chairman  of  the  Joint  Chiefs  of  Staff 
course  of  action 
communications  intelligence 
communications  security 
operation  plan  in  concept  format 

EEFI 

ELINT 

EW 

essential  elements  of  friendly  information 
electronics  intelligence 
electronic  warfare 

FISINT 

foreign  instrumentation  signals  intelligence 

HUMINT 

human  intelligence 

IMINT 

IW 

imagery  intelligence 
information  warfare 

JFC 

JOPES 

joint  force  commander 

Joint  Operation  Planning  and  Execution  System 

LEA 

law  enforcement  agency 

MASINT 

MOOTW 

MOP 

measurement  and  signature  intelligence 
military  operations  other  than  war 
memorandum  of  policy 

NCA 

national  command  authorities 

OPLAN 

OPORD 

OPSEC 

OSINT 

operation  plan  in  complete  format 
operation  order 
operations  security 
open  source  intelligence 

PSYOP 

psychological  operations 

SIGINT 

SIGSEC 

SOP 

signals  intelligence 

signals  security 

standard  operating  procedure 

Glossary 


TECHINT 

UHF 

WAN 


technical  intelligence 
ultra  high  frequency 
wide-area  network 
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PART  II— TERMS  AND  DEFINITIONS 


command  and  control  warfare.  The 

integrated  use  of  operations  security 
(OPSEC),  military  deception,  psychological 
operations  (PSYOP),  electronic  warfare 
(EW),  and  physical  destruction,  mutually 
supported  by  intelligence,  to  deny 
information  to,  influence,  degrade,  or 
destroy  adversary  command  and  control 
capabilities,  while  protecting  friendly 
command  and  control  capabilities  against 
such  actions.  Command  and  control 
warfare  is  a  warfighting  application  of 
information  warfare  in  military  operations 
and  is  a  subset  of  information  warfare. 
Command  and  control  warfare  applies 
across  the  range  of  military  operations  and 
all  levels  of  conflict.  Also  called  C2W. 
C2W  is  both  offensive  and  defensive:  a. 
C2-attack.  Prevent  effective  C2  of 
adversary  forces  by  denying  information  to, 
influencing,  degrading,  or  destroying  the 
adversary  C2  system,  b.  C2-protect. 
Maintain  effective  command  and  control 
of  own  forces  by  turning  to  friendly 
advantage  or  negating  adversary  efforts  to 
deny  information  to,  influence,  degrade  or 
destroy  the  friendly  C2  system.  (Joint  Pub 
1-02) 

critical  information.  Specific  facts  about 
friendly  intentions,  capabilities,  and 
activities  vitally  needed  by  adversaries  for 
them  to  plan  and  act  effectively  so  as  to 
guarantee  failure  or  unacceptable 
consequences  for  friendly  mission 
accomplishment.  (Joint  Pub  1-02) 

essential  elements  of  friendly  information. 

Key  questions  likely  to  be  asked  by 
adversary  officials  and  intelligence  systems 
about  specific  friendly  intentions, 
capabilities,  and  activities,  so  they  can 
obtain  answers  critical  to  their  operational 
effectiveness.  Also  called  EEFI.  (Joint  Pub 
1-02) 


operations  security.  A  process  of  identifying 
critical  information  and  subsequently 
analyzing  friendly  actions  attendant  to 
military  operations  and  other  activities  to: 

a.  Identify  those  actions  that  can  be 
observed  by  adversary  intelligence  systems. 

b.  Determine  indicators  hostile  intelligence 
systems  might  obtain  that  could  be 
interpreted  or  pieced  together  to  derive 
critical  information  in  time  to  be  useful  to 
adversaries. 

c.  Select  and  execute  measures  that 
eliminate  or  reduce  to  an  acceptable  level 
the  vulnerabilities  of  friendly  actions  to 
adversary  exploitation.  Also  called 
OPSEC.  (Joint  Pub  1-02) 

operations  security  indicators.  Friendly 
detectable  actions  and  open-source 
information  that  can  be  interpreted  or  pieced 
together  by  an  adversary  to  derive  critical 
information.  (Joint  Pub  1-02) 

operations  security  measures.  Methods  and 
means  to  gain  and  maintain  essential 
secrecy  about  critical  information.  The 
following  categories  apply: 

a.  action  control.  The  objective  is  to 
eliminate  indicators  or  the  vulnerability  of 
actions  to  exploitation  by  adversary 
intelligence  systems.  Select  what  actions 
to  undertake;  decide  whether  or  not  to 
execute  actions;  and  determine  the  “who,” 
“when,”  “where,”  and  “how”  for  actions 
necessary  to  accomplish  tasks. 

b.  countermeasures.  The  objective  is  to 
disrupt  effective  adversary  information 
gathering  or  prevent  their  recognition  of 
indicators  when  collected  materials  are 
processed.  Use  diversions,  camouflage. 


Glossary 


concealment,  jamming,  threats,  police 
powers,  and  force  against  adversary 
information  gathering  and  processing 
capabilities. 

c.  counteranalysis.  The  objective  is  to 
prevent  accurate  interpretations  of 
indicators  during  adversary  analysis  of 
collected  materials.  This  is  done  by 
confusing  the  adversary  analyst  through 
deception  techniques  such  as  covers.  (Joint 
Pub  1-02) 

operations  security  planning  guidance. 

Guidance  that  serves  as  the  blueprint  for 
OPSEC  planning  by  all  functional  elements 
throughout  the  organization.  It  defines  the 
critical  information  that  requires  protection 


from  adversary  appreciations,  taking  into 
account  friendly  and  adversary  goals, 
estimated  key  adversary  questions, 
probable  adversary  knowledge,  desirable 
and  harmful  adversary  appreciations,  and 
pertinent  intelligence  system  threats.  It  also 
should  outline  provisional  operations 
security  measures  to  ensure  the  requisite 
essential  secrecy.  (Joint  Pub  1-02) 

operations  security  vulnerability.  A 

condition  in  which  friendly  actions  provide 
OPSEC  indicators  that  may  be  obtained  and 
accurately  evaluated  by  an  adversary  in 
time  to  provide  a  basis  for  effective 
adversary  decisionmaking.  (Joint  Pub 
1-02) 
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PERSONNEL 
and 

1]  ADMINISTRATION  I 


All  joint  doctrine  and  tactics,  techniques,  and  procedures  are  organized  into  a  comprehensive  hierarchy 
as  shown  in  the  chart  above.  Joint  Pub  3-54  is  in  the  Operations  series  of  joint  doctrine  publications. 
The  diagram  below  illustrates  an  overview  of  the  development  process; 


STEP  #5 

Assessinents/Revision 

O  The  CiNCS  receive  the  pub  and 
begin  to  assess  it  during  use 

O  18  to  24  months  following 
publication,  the  Director  J-7,  will 
solicit  a  written  report  from  the 
combatant  commands  and 
Services  on  the  utility  and  quality 
of  each  pub  and  the  need  for  any 
urgent  changes  or  earlier-than- 
scheduled  revisions 

O  No  later  than  5  years  after 
development,  each  pub  is  revised 


STEP#1 

Project  Proposal 

©  Submitted  by  Services,  CINCS,  or  Joint  Staff 
to  fill  extant  operational  void 


STEP  #2 

Program  Directive 

®  J-7  formally  staffs  with 
Services  and  CINCS 

®  Includes  scope  of  project, 
references,  milestones, 
and  who  will  develop 
drafts 

©  J-7  releases  Program 
Directive  to  Lead  Agent. 
Lead  Agent  can  be 
Service,  CINC,  or  Joint 
Staff  (JS)  Directorate 


STEP  #4t 

... 

STEP  #3 

CJCS  Approval 

Two  Drafts 

O  Lead  Agent  forwards  proposed  pub  to  Joint  Staff 

O  Joint  Staff  takes  responsibility  for  pub,  makes 

©  Lead  Agent  selects  Primary  Review  Authority 
(PRA)  to  develop  the  pub 

required  changes  and  prepares  pub  for 
coordination  with  Services  and  CINCS 

©  PRA  develops  two  draft  pubs 

©  PRA  staffs  each  draft  with  CINCS,  Services, 

O  Joint  Staff  conducts  formal  staffing  for  approval 

and  Joint  Staff 

as  a  Joint  Publication 

